CVE-2024-37959 is a stored cross-site scripting vulnerability (CWE-79) in the Atlas Public Policy Power BI Embedded plugin for WordPress, affecting all versions through 1.1.7. The vulnerability is due to improper input neutralization during web page generation, which allows an attacker with high privileges to inject malicious scripts that execute in the context of other users. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges are high, user interaction is required, and the scope is changed with limited impact on confidentiality, integrity, and availability. No official fix or vendor advisory has been published yet, and no known exploitation has been reported.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject and store malicious scripts that execute in the browsers of other users, potentially leading to limited confidentiality, integrity, and availability impacts. However, exploitation requires user interaction and high privileges, which reduces the overall risk. No known exploits in the wild have been reported to date.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates and apply any official fixes once released. Until then, restrict high-privilege access to the plugin and limit user interactions that could trigger the vulnerability. Avoid exposing the affected plugin to untrusted users.