This vulnerability (CVE-2024-43986) in MagePeople Team Taxi Booking Manager for WooCommerce is classified as CWE-79, indicating improper neutralization of input leading to stored cross-site scripting (XSS). The issue affects versions through 1.0.9 and allows an attacker with high privileges and requiring user interaction to inject malicious scripts that execute within the victim's browser session. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) reflects network attack vector, low attack complexity, high privileges required, user interaction needed, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users' browsers, potentially leading to partial confidentiality, integrity, and availability impacts. This could result in unauthorized actions performed on behalf of users or disclosure of sensitive information accessible in the browser session. However, exploitation requires user interaction and high privileges, limiting the ease of attack.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict high-privilege user access to trusted individuals and monitor for suspicious activity related to the plugin. Avoid exposing the affected plugin to untrusted users. Follow vendor channels for updates on patches or mitigations.