The vulnerability identified as CVE-2024-34811 in VeronaLabs WP SMS is a stored cross-site scripting (CWE-79) issue caused by improper input neutralization during web page generation. This flaw allows attackers with high privileges to inject malicious scripts that can be executed in the context of users viewing the affected pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges are high, user interaction is required, scope is changed, and impacts confidentiality, integrity, and availability at a low level. The affected product versions include all up to 6.5.1. No patch or official remediation guidance is currently available from the vendor.

Successful exploitation could allow an attacker with high privileges to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, modification, or disruption of service. The impact is rated as medium severity with partial confidentiality, integrity, and availability impacts. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit high-privilege user access and exercise caution with user-generated content in the WP SMS plugin. Monitor for updates from VeronaLabs regarding patches or mitigations.