This vulnerability (CVE-2024-37955) involves improper neutralization of input in the GutSlider – All in One Block Slider WordPress plugin, leading to stored Cross-site Scripting (CWE-79). The issue affects all versions up to 2.7.3. The CVSS 3.1 score of 6.5 reflects a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts confidentiality, integrity, and availability to a limited extent. No vendor advisory or patch information is currently available, and the plugin is not a cloud service.

Successful exploitation could allow an attacker with some privileges to inject malicious scripts that are stored and executed in the context of users viewing the affected pages. This can lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting privileges for users who can input data into the plugin and avoid interacting with untrusted content generated by the plugin. Monitor for updates from the vendor or trusted security sources regarding patches or workarounds.