The vulnerability CVE-2024-54353 affects the wpgear Hack-Info plugin through a CSRF flaw that enables stored XSS attacks. Specifically, the plugin versions up to 3.17 are vulnerable. The attack requires user interaction but no privileges and can be executed remotely over the network. The vulnerability can lead to a partial compromise of confidentiality, integrity, and availability as indicated by the CVSS vector. No patch or official remediation guidance has been provided in the available data.

Successful exploitation of this vulnerability can allow an attacker to inject and store malicious scripts via CSRF, potentially leading to stored XSS attacks. This can result in unauthorized actions performed on behalf of authenticated users, data manipulation, or disruption of service. The impact affects confidentiality, integrity, and availability at a low to moderate level as per the CVSS metrics.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting access to the affected plugin and apply standard CSRF mitigations such as verifying request origins and using anti-CSRF tokens where possible.