The vulnerability CVE-2024-54439 affects the Amazon Product Price plugin by Alok Tiwari, allowing CSRF attacks that can result in stored XSS. This means that an attacker can trick an authenticated user into submitting a request that the application processes, potentially injecting malicious scripts stored on the server. The affected versions are up to and including 1.1. The CVSS 3.1 base score is 7.1, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to stored XSS, which may allow attackers to execute arbitrary scripts in the context of the victim's browser. This can result in session hijacking, defacement, or other malicious actions. The CSRF aspect means that attackers can induce authenticated users to perform unwanted actions without their consent. The overall impact is high due to the combination of CSRF and stored XSS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider disabling or removing the affected plugin if possible. Additionally, implementing standard CSRF protections and input sanitization can help mitigate risk. Monitor vendor channels for updates regarding an official fix.