The vulnerability CVE-2024-37101 in AF themes WP Post Author plugin (up to version 3.6.7) is a stored cross-site scripting (CWE-79) issue caused by improper input neutralization during web page generation. This allows an attacker with low privileges and requiring user interaction to execute arbitrary scripts in the context of the affected web application, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 6.5 with network attack vector, low attack complexity, low privileges required, user interaction required, and scope changed.

Successful exploitation can lead to execution of malicious scripts in the context of the affected site, potentially allowing attackers to steal user credentials, perform actions on behalf of users, or disrupt availability. The impact includes limited confidentiality, integrity, and availability loss as indicated by the CVSS vector. No known active exploitation has been reported.

No official patch or remediation is currently available. Users should monitor the vendor's advisory channels for updates. Until a fix is released, consider restricting plugin usage to trusted users and minimizing exposure to untrusted input. Avoid enabling features that allow user-generated content without validation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.