CVE-2024-37561 is a stored Cross-site Scripting (XSS) vulnerability classified under CWE-79 in the Jamie Bergen Plugin Notes Plus. It affects versions up to 1.2.6 and results from improper input neutralization during web page generation. This allows an attacker with high privileges to inject malicious scripts that are stored and later executed when viewed by other users, potentially leading to limited confidentiality, integrity, and availability impacts. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting medium severity. No official patch or remediation guidance is currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute in the context of other users, potentially leading to limited disclosure of information, modification of data, or disruption of service. The impact is limited by the requirement for high privileges and user interaction. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin to trusted users only and consider disabling or removing the plugin if feasible. Monitor for updates from the vendor regarding patches or mitigations.