This vulnerability (CVE-2024-32597) in the Xylus Themes WordPress Importer plugin allows stored cross-site scripting (CWE-79) due to improper input neutralization during web page generation. It affects versions up to 1.0.7. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and a scope change with low confidentiality, integrity, and availability impacts. No patch or official remediation level has been published. The vulnerability could allow an attacker with sufficient privileges to inject malicious scripts that execute in the context of other users.

Successful exploitation could lead to execution of arbitrary scripts in the context of the affected WordPress site, potentially allowing attackers to steal sensitive information, perform actions on behalf of other users, or disrupt site availability. The impact is rated medium based on the CVSS score of 5.9. The attack requires high privileges and user interaction, limiting the ease of exploitation. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit plugin usage to trusted administrators and avoid exposing the WordPress Importer interface to untrusted users. Monitor vendor channels for updates and apply patches promptly once available.