CVE-2024-32548 is a stored cross-site scripting vulnerability (CWE-79) in Hideki Tanaka's What's New Generator software, affecting versions through 2.0.2. It results from improper neutralization of input during web page generation, enabling attackers with high privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting medium severity with impacts on confidentiality, integrity, and availability. No official patch or remediation level has been published, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute when other users view the affected pages. This can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. However, exploitation requires user interaction and elevated privileges, limiting the risk scope. No known active exploitation has been reported.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a fix is released, limit access to the affected software to trusted users with high privileges and consider applying web application firewall rules or input validation controls to mitigate stored XSS risks.