This vulnerability (CVE-2024-34796) in AccessAlly PopupAlly is a Stored Cross-site Scripting (CWE-79) issue caused by improper input neutralization during web page generation. It affects PopupAlly versions through 2.1.1. The CVSS 3.1 base score is 5.9, indicating medium severity, with an attack vector of network, low attack complexity, requiring high privileges and user interaction, and impacts confidentiality, integrity, and availability at a low level. No patch or official remediation level has been provided by the vendor as of the publication date.

Successful exploitation could allow an attacker with high privileges and requiring user interaction to inject and store malicious scripts in the PopupAlly plugin, potentially leading to limited confidentiality, integrity, and availability impacts within affected environments. However, no known exploits are currently reported in the wild.

No official patch or remediation is currently available for this vulnerability. Users should follow vendor advisories for updates. Until a fix is released, consider restricting high-privilege user access to the PopupAlly plugin and exercising caution with user-generated content to reduce risk.