This vulnerability (CVE-2024-37121) in biplob018 Shortcode Addons allows stored cross-site scripting (CWE-79) due to improper input neutralization during web page generation. It affects versions up to 3.2.5 and requires an attacker with high privileges and user interaction to exploit. The vulnerability can lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L). No patch or official remediation level has been published by the vendor, and it is not a cloud service. No known exploits have been reported.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The vulnerability requires user interaction and privileges, limiting the ease of exploitation. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin to trusted users only and consider disabling or removing the plugin if feasible. Monitor vendor channels for updates regarding patches or mitigations.