CVE-2024-56260 is a stored cross-site scripting vulnerability in StorePlugin's ShopElement component (versions up to 2.0.0). It results from improper input neutralization during web page generation, enabling attackers to inject malicious scripts that persist and execute in the context of users' browsers. The vulnerability has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, required privileges, and user interaction, with partial impact on confidentiality, integrity, and availability. No patch or official fix information is provided, and no known exploitation has been reported.

Successful exploitation of this vulnerability allows an attacker to inject and store malicious scripts within the ShopElement web pages, which execute when viewed by other users. This can lead to partial compromise of confidentiality, integrity, and availability of affected users' sessions or data. The vulnerability requires user interaction and some privileges, limiting the ease of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider applying input validation or output encoding workarounds if feasible within the application environment.