CVE-2024-37259 describes a cross-site scripting vulnerability in WP Extended The Ultimate WordPress Toolkit plugin for WordPress, affecting versions up to 2.4.7. The vulnerability is due to improper neutralization of input during web page generation, which could allow an attacker to execute arbitrary scripts in the context of the affected site. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at low levels.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected website, potentially leading to partial disclosure of information, modification of data, or disruption of service. The CVSS score of 7.1 reflects a high severity impact with confidentiality, integrity, and availability impacts rated as low. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the affected plugin. Monitor vendor channels for updates and apply patches promptly once available.