This vulnerability (CVE-2024-37100) involves improper neutralization of input during web page generation in Elegant Themes Icons, leading to stored cross-site scripting (CWE-79). It affects versions through 1.3 and allows an attacker with low privileges and requiring user interaction to execute scripts in the context of the affected application. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at a low to medium level.

Successful exploitation can result in execution of arbitrary scripts in the context of the affected application, potentially leading to information disclosure, modification of data, or disruption of service. The impact is rated medium based on the CVSS score of 6.5. There are no reports of active exploitation in the wild.

No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider limiting exposure by restricting input sources or applying web application firewall rules to detect and block malicious payloads related to stored XSS in Elegant Themes Icons.