The vulnerability CVE-2024-39627 in Imagely NextGEN Gallery is a stored Cross-site Scripting (CWE-79) flaw caused by improper input sanitization during web page generation. This allows attackers with high privileges to inject malicious scripts that execute in the context of other users viewing the affected pages. The issue affects versions through 3.59.3. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability. No official patch or remediation level has been published by the vendor yet.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the browsers of users who view the affected content, potentially leading to data theft, session hijacking, or other client-side impacts. The overall impact is rated medium due to the requirement for high privileges and user interaction, and the limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit administrative access to trusted users only and consider disabling or restricting the use of the NextGEN Gallery plugin if possible. Monitor official Imagely communications for updates on patches or mitigations.