The vulnerability identified as CVE-2024-5669 affects the Happy WooCommerce FAQs – Ultimate Product FAQ Plugin for WordPress. It is caused by a missing capability check in the 'ffw_activate_template' function, allowing authenticated users with low privileges (Subscriber-level and above) to inject stored cross-site scripting payloads. These payloads trigger upon viewing dashboard templates or FAQ sections, potentially leading to limited confidentiality and integrity impacts. The CVSS 3.1 score is 6.4 (medium severity) with network attack vector, low attack complexity, privileges required, no user interaction, and scope changed. No patch or vendor advisory is currently available, and the plugin is not a cloud service.

An authenticated attacker with Subscriber-level access or higher can exploit this vulnerability to store cross-site scripting payloads that execute in the context of the WordPress dashboard or FAQ views. This may lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions within the dashboard. There is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious activity related to FAQ template modifications. Avoid granting Subscriber-level access to untrusted users. Follow updates from the plugin vendor for official patches or temporary mitigations.