This vulnerability (CVE-2024-37948) involves improper input sanitization in the PootlePress Caxton – Create Pro page layouts plugin for Gutenberg, leading to stored cross-site scripting (CWE-79). An attacker with low privileges can inject malicious scripts that execute when other users view the affected content. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction needed, and impacts confidentiality, integrity, and availability to a limited extent. The issue affects all versions up to 1.30.1. No patch or official remediation level has been published by the vendor as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to limited confidentiality, integrity, and availability impacts. This could result in unauthorized actions performed on behalf of users or disclosure of sensitive information within the application context. However, exploitation requires user interaction and low privileges, which somewhat limits the attack scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when installing or using the affected plugin versions and consider restricting access to trusted users only. Monitoring for updates from PootlePress is recommended to apply any forthcoming patches promptly.