This vulnerability (CVE-2024-35708) in apollo13themes Rife Free theme is a stored cross-site scripting (CWE-79) issue caused by improper input sanitization during web page generation. It affects all versions through 2.4.19. An attacker with low privileges and requiring user interaction can inject malicious scripts that may execute in the context of other users, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected site. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, and partial impact on confidentiality, integrity, and availability. No patch or official fix has been published yet.

Successful exploitation can lead to stored XSS attacks, allowing attackers to execute arbitrary scripts in the context of other users. This can result in partial disclosure of sensitive information, modification of site content, or disruption of availability. The attack requires low privileges and user interaction but can affect multiple users due to the stored nature of the vulnerability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting user input capabilities, applying web application firewall (WAF) rules to detect and block XSS payloads, and monitoring for suspicious activity related to script injection. Avoid granting unnecessary privileges to users who can submit content that is rendered on the site.