The Newsletter plugin for WordPress (satollo) contains a stored cross-site scripting vulnerability identified as CVE-2024-5317. This vulnerability is due to improper neutralization of input during web page generation (CWE-79) specifically involving the 'np1' parameter. Attackers can inject malicious scripts that persist and execute in the context of users visiting the affected pages. The vulnerability affects all versions up to 8.3.4. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary scripts in the context of users viewing the affected pages. This can lead to partial compromise of confidentiality and integrity of user data within the affected application context. There is no direct impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected plugin or disabling it if feasible to reduce exposure.