The vulnerability CVE-2024-34546 affects the Sticky Social Link plugin (<= 2.0.1) by Habibur Rahman. It is a DOM-based Cross-site Scripting (XSS) issue caused by improper neutralization of input during web page generation. The CVSS 3.1 base score is 5.9 (medium), with attack vector network, low attack complexity, requiring high privileges and user interaction, and impacts confidentiality, integrity, and availability at a low level. No official patch or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker with high privileges and user interaction to execute arbitrary scripts in the context of the affected web application, potentially leading to limited confidentiality, integrity, and availability impacts. However, the requirement for high privileges and user interaction reduces the likelihood and severity of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit exposure by restricting high-privilege access to the plugin and exercising caution with user inputs that interact with the plugin. Monitor for updates from the vendor or trusted security sources.