CVE-2024-33639 is a stored cross-site scripting vulnerability (CWE-79) in AccessAlly PopupAlly plugin versions up to 2.1.1. It occurs due to improper neutralization of input during web page generation, enabling attackers with high privileges to inject malicious scripts that execute in the context of other users. The CVSS 3.1 base score is 5.9 (medium severity) with vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L, indicating network attack vector, low attack complexity, required high privileges, user interaction needed, and impacts on confidentiality, integrity, and availability. No patch or official remediation is currently available.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute when other users view affected pages, potentially leading to limited confidentiality, integrity, and availability impacts. The vulnerability requires user interaction and high privileges, reducing the likelihood of widespread exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit access to high privilege accounts and exercise caution with user input handling in PopupAlly. Monitor vendor communications for updates on patches or mitigations.