CVE-2024-51863 describes a stored cross-site scripting vulnerability in the Profit Funnels PF Timer plugin (versions up to 1.0.0). This vulnerability results from improper input neutralization during web page generation, enabling attackers to inject malicious scripts that persist and execute in the context of other users. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with partial impact on confidentiality, integrity, and availability. No patch or official fix information is currently available, and no known exploits have been reported.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system or user data. The CVSS score of 6.5 reflects a medium severity impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting access to the affected plugin and applying any available security controls that can mitigate XSS risks, such as input validation or web application firewalls. Monitor vendor channels for updates and apply patches promptly once released.