CVE-2024-33951 describes a stored cross-site scripting vulnerability (CWE-79) in the Perfect Pullquotes plugin by Adam DeHaven, affecting versions through 1.7.5. The issue is caused by improper input neutralization during web page generation, which allows an attacker to inject malicious scripts that persist and execute in the context of other users' browsers. The vulnerability has a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), indicating network attack vector, low attack complexity, requiring low privileges and user interaction, with scope changed and partial impact on confidentiality, integrity, and availability. No official remediation or patch information is currently available, and no known active exploitation has been reported.

Successful exploitation of this vulnerability can lead to stored cross-site scripting attacks, enabling attackers to execute arbitrary scripts in the context of affected users. This can result in partial loss of confidentiality, integrity, and availability of the affected system or user data. The vulnerability requires low privileges and user interaction to exploit and affects the scope of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with input handling and consider applying temporary mitigations such as disabling or restricting the use of the Perfect Pullquotes plugin if feasible. Monitor official channels for updates and patches from Adam DeHaven.