This vulnerability (CVE-2024-38677) in REVIEWS.io involves improper input sanitization that leads to stored cross-site scripting (CWE-79). Attackers can inject malicious scripts that persist on the platform and execute in the context of other users' browsers. The affected versions include all versions up to 1.2.7. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with impacts on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users visiting the affected web pages, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. However, no known active exploitation has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, users should exercise caution when interacting with the affected product and monitor for updates from Reviews.co.uk. Avoid clicking on suspicious links or inputting untrusted data until a patch is released.