This vulnerability (CVE-2024-33950) is an improper input neutralization issue classified under CWE-79, resulting in cross-site scripting within the Archives Calendar Widget developed by Aleksei Polechin. It affects versions up to 1.0.15 and requires administrator privileges and user interaction to exploit. The CVSS 3.1 base score is 5.9 (medium), reflecting network attack vector, low attack complexity, high privileges required, and user interaction needed. The vulnerability can lead to partial confidentiality, integrity, and availability impacts. No patch or official remediation level has been published by the vendor or the assigner Patchstack as of the publication date.

Successful exploitation could allow an attacker with administrator privileges to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of information, modification of data, or disruption of service. The impact is limited by the requirement for high privileges and user interaction. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with input handling and consider restricting administrator access to trusted users only. Monitor vendor channels for updates regarding patches or official mitigations.