This vulnerability (CVE-2024-35642) involves improper input sanitization in the Site Favicon product by Bryan Hadaway, leading to stored Cross-site Scripting (CWE-79). An attacker can inject malicious scripts that get stored and later executed in the context of users visiting the affected web pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and impacts confidentiality, integrity, and availability at a low level. No official fix or patch has been published, and no known exploits are reported.

Successful exploitation could allow an attacker with high privileges and requiring user interaction to execute arbitrary scripts in the context of affected users, potentially leading to data disclosure, modification, or denial of service. The impact is rated medium with low confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit exposure by restricting high privilege user access and minimizing user interaction with potentially vulnerable components. Monitor vendor channels for updates and apply patches promptly once released.