This vulnerability (CVE-2024-32594) affects AttesaWP's Attesa Extra plugin up to version 1.3.9. It is classified as CWE-79, indicating improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). An attacker with at least low privileges and requiring user interaction could inject malicious scripts that execute in the context of other users, potentially impacting confidentiality, integrity, and availability. The CVSS vector indicates network attack vector, low attack complexity, privileges required, user interaction required, and scope changed with low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, session hijacking, or other impacts on user data and application integrity. The CVSS score of 6.5 reflects a medium impact level with partial confidentiality, integrity, and availability impacts. No known active exploitation has been reported.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider limiting privileges of users who can submit input and apply any available web application firewall (WAF) rules to detect or block XSS payloads relevant to this plugin.