CVE-2024-47381 describes a stored cross-site scripting vulnerability in the averta Depicter Slider plugin (versions up to 3.2.2). This vulnerability is due to improper input neutralization during web page generation, which allows attackers with high privileges to inject malicious scripts that are stored and later executed when other users view the affected content. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting network attack vector, low attack complexity, required privileges, and user interaction. There is no vendor advisory or patch information currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. Because this is a stored XSS, the malicious payload can persist and affect multiple users. However, exploitation requires user interaction and elevated privileges, which limits the overall impact severity to medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privilege user access to the Depicter Slider plugin and monitor for suspicious activity related to content injection. Avoid enabling untrusted users to input content that is rendered by the plugin.