CVE-2024-58292 is a persistent cross-site scripting vulnerability in XMB Forum 1.9.12.06. It arises from improper neutralization of input during web page generation (CWE-79). Authenticated administrators can inject malicious JavaScript into footer templates and news ticker fields, which then execute in the browsers of all forum users when the affected pages are rendered. This vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No patch or official fix information is currently available, and the product is not a cloud service.

Successful exploitation allows an authenticated administrator to inject persistent malicious scripts that execute in the context of other forum users' browsers. This can lead to session hijacking, defacement, or other client-side attacks impacting all users who visit the compromised pages. The vulnerability requires administrator privileges to exploit, limiting the attack surface to trusted users with elevated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only and review templates and front page settings for unauthorized script content. Monitor for suspicious changes in footer templates and news ticker fields. No official patch or workaround is currently documented.