The Dynamic "To Top" plugin version 3.5.2 contains a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability that enables stored cross-site scripting (XSS). This occurs when user input is not properly sanitized before being included in web pages, allowing attackers to inject malicious scripts that persist and execute in the context of other users' browsers. The vulnerability affects version 3.5.2 and has been assigned CVE-2024-52494 with a CVSS 3.1 score of 5.9, indicating medium severity. No patch or official remediation has been disclosed as of the publication date.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of users visiting affected sites, potentially leading to information disclosure, session hijacking, or other impacts related to script execution. The CVSS vector indicates the attack requires network access, low attack complexity, high privileges, and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low-medium. There are no known exploits in the wild at this time.

No official patch or remediation guidance is currently available for this vulnerability. Users should monitor the vendor's advisories for updates and apply any forthcoming patches promptly. Until a fix is released, consider restricting user input or employing web application firewalls that can detect and block XSS payloads relevant to this plugin. Avoid relying on generic mitigations that are not specific to this vulnerability.