The vulnerability CVE-2024-50541 affects the Advanced Control Manager for WordPress plugin by ItalyStrap (versions <= 2.16.0). It is a stored cross-site scripting (XSS) issue caused by improper input neutralization during web page generation. Attackers could inject malicious scripts that are stored and later executed in the context of other users, potentially leading to information disclosure, session hijacking, or other impacts consistent with stored XSS vulnerabilities. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, requiring privileges and user interaction, with impacts on confidentiality, integrity, and availability rated as low to medium. There is no vendor advisory or patch information provided, and no known exploits have been reported.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of users interacting with the affected plugin interface. This may lead to limited confidentiality, integrity, and availability impacts such as session hijacking, defacement, or unauthorized actions performed on behalf of the user. The medium severity score reflects these potential impacts, but no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected plugin features to trusted users only and applying web application firewall (WAF) rules to detect and block XSS payloads targeting this plugin. Monitor official ItalyStrap or WordPress plugin repositories for updates addressing this vulnerability.