CVE-2024-35679 describes an improper input neutralization vulnerability in the StellarWP GiveWP plugin for WordPress, leading to cross-site scripting (XSS). This vulnerability affects all versions up to 3.12.0. An attacker could exploit this flaw by injecting malicious scripts into web pages generated by the plugin, potentially impacting confidentiality, integrity, and availability as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The vulnerability is publicly disclosed but no vendor advisory or patch information is provided in the input.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary scripts in the context of users visiting affected web pages. This can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. The CVSS score of 7.1 reflects a high impact with network attack vector, low attack complexity, no privileges required, but user interaction needed, and scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure by restricting access to affected plugin features or applying temporary mitigations if provided by the vendor. Monitor official StellarWP channels for updates and apply patches promptly once released.