CVE-2024-34766 is a stored cross-site scripting (XSS) vulnerability classified under CWE-79 in the Automattic ChaosTheory product, affecting versions through 1.3. The issue arises from improper neutralization of input during web page generation, allowing attackers to inject and persist malicious scripts. The vulnerability has a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), indicating network attack vector, low attack complexity, requiring low privileges and user interaction, with scope changed and impacts on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by the vendor as of the published date.

The vulnerability allows an attacker with low privileges and requiring user interaction to execute stored malicious scripts in the context of affected users, potentially leading to partial confidentiality, integrity, and availability impacts. This can result in unauthorized actions or data exposure within the scope of the affected application. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor Automattic's advisories for updates. Until a patch is available, consider applying application-level input validation or output encoding as a temporary mitigation if feasible.