This vulnerability (CVE-2024-37546) involves improper input sanitization in the biplob018 Image Hover Effects - Caption Hover with Carousel plugin, leading to stored cross-site scripting (CWE-79). Attackers can inject malicious scripts that are stored and later executed in the context of users visiting affected pages. The issue affects versions up to 3.0.2. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low-medium. No official fix or patch is currently documented, and no known active exploitation has been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users' browsers, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The impact is rated medium severity based on the CVSS score of 6.5. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin version to mitigate risk. Monitor vendor channels for updates or patches addressing this vulnerability.