This vulnerability, identified as CVE-2024-51814, is a DOM-based Cross-site Scripting (XSS) flaw in the 野人 活动链接推广插件 (yr-activity-link) plugin, affecting versions up to 1.2.0. It arises from improper neutralization of input during web page generation, allowing malicious scripts to be executed in the context of the affected web application. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, requiring privileges and user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to partial disclosure of information, modification of data, or disruption of service within the context of the affected plugin. The attack requires user interaction and some privileges, limiting the ease of exploitation. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided, users should monitor for updates from the plugin vendor. Until a fix is available, consider restricting privileges for users interacting with the plugin and educating users to avoid interacting with untrusted content that could trigger the vulnerability.