CVE-2024-54437 describes a stored cross-site scripting vulnerability in the jCarousel WordPress plugin by koolkatwebdesigns. The issue is caused by improper input neutralization during web page generation, which allows attackers to inject persistent malicious scripts. This affects versions up to and including 1.0 of the plugin. The vulnerability has a CVSS 3.1 base score of 7.1, reflecting network attack vector, low complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory information is provided, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to theft of user credentials, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The CVSS score of 7.1 indicates a high severity impact. However, no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected jCarousel plugin or applying any temporary mitigations recommended by the vendor. Monitor official koolkatwebdesigns communications for updates on patches or workarounds.