The vulnerability identified as CVE-2024-35680 affects YITH WooCommerce Product Add-Ons plugin versions up to 4.9.2. It is caused by improper neutralization of script-related HTML tags in web pages, which leads to a basic cross-site scripting (XSS) flaw. This can allow an attacker to inject and execute malicious scripts in the context of the affected web application. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges or user interaction, impacting data integrity but not confidentiality or availability. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

The vulnerability allows an attacker to perform cross-site scripting attacks that can alter the integrity of the affected web pages by injecting malicious scripts. This could lead to unauthorized script execution in users' browsers, potentially enabling actions such as session hijacking or content manipulation. However, the CVSS score indicates no direct impact on confidentiality or availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor YITHEMES advisories for updates. Until a patch is available, consider applying temporary mitigations such as disabling the affected plugin or restricting access to affected functionality if feasible.