CVE-2024-56274 describes a stored cross-site scripting vulnerability in Brainstorm Force Astra Widgets (<= 1.2.15). The vulnerability is due to improper neutralization of input during web page generation, which can lead to the injection and execution of malicious scripts. The CVSS 3.1 base score is 6.5, with attack vector network, low attack complexity, requiring low privileges and user interaction, and impacts on confidentiality, integrity, and availability at a low level. No patch or vendor advisory details are provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users viewing the affected Astra Widgets pages. This may lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. However, no known exploits in the wild have been reported, and the impact is rated medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure to untrusted input in Astra Widgets and monitor for updates from Brainstorm Force regarding patches or mitigations.