CVE-2024-35170 describes a stored cross-site scripting vulnerability (CWE-79) in the Hidden Depth Sticky banner product, versions up to 1.2.0. The issue is caused by improper neutralization of input during web page generation, which allows an attacker with high privileges to inject malicious scripts that are stored and later executed in the context of other users. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting network attack vector, low attack complexity, required privileges, required user interaction, and partial impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject malicious scripts that execute in the browsers of users who view the affected Sticky banner content. This can lead to partial compromise of confidentiality, integrity, and availability of user data or sessions. However, exploitation requires user interaction and elevated privileges, which limits the overall risk. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to high-privilege accounts and carefully validate or sanitize inputs that may be rendered by the Sticky banner. Monitor vendor channels for updates or patches addressing this vulnerability.