The vulnerability CVE-2024-50413 involves improper input neutralization in the Import and export users and customers plugin by Javier Carazo, leading to stored cross-site scripting (XSS). This occurs during the processing of CSV imports with metadata, allowing malicious scripts to be stored and later executed in the context of the web application. The affected versions include all up to 1.27.5. The CVSS vector indicates the attack requires network access, low attack complexity, high privileges, and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low-medium.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users, potentially leading to data disclosure, modification, or disruption of service. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the import functionality to trusted users only and apply input validation or sanitization controls where possible. Monitor for updates from the vendor regarding official patches or mitigations.