This vulnerability (CVE-2024-37537) in UusWeb.ee WS Contact Form versions up to 1.3.7 is a stored Cross-site Scripting (CWE-79) issue caused by improper input neutralization during web page generation. An attacker with high privileges and requiring user interaction can inject malicious scripts that persist in the application and execute in the context of other users. The CVSS 3.1 base score is 5.9, reflecting medium severity with network attack vector, low attack complexity, and impact on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of affected users, potentially resulting in limited confidentiality, integrity, and availability impacts. The attack requires high privileges and user interaction, reducing the likelihood of widespread exploitation. No known active exploits have been reported.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict high privilege access to the WS Contact Form and limit user interactions with untrusted inputs. Monitor vendor communications for updates.