CVE-2024-58296 is a stored cross-site scripting vulnerability in CE Phoenix version 1.0.8.20. The issue exists in the currencies administration panel where input in the title field is not properly neutralized during web page generation. This allows an attacker to inject malicious JavaScript payloads that execute in the context of the administrator's browser upon viewing the currencies page. The vulnerability does not require privileges or user interaction beyond viewing the page and has a medium impact score.

Successful exploitation enables attackers to execute arbitrary JavaScript in the administrator's browser context, potentially leading to session hijacking, unauthorized actions, or other attacks leveraging the administrator's privileges. The vulnerability affects the confidentiality and integrity of the administrative interface but requires the administrator to view the maliciously crafted currencies page.

No patch or official fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict access to the currencies administration panel to trusted administrators only and consider additional input validation or sanitization controls if possible. Avoid viewing untrusted or suspicious currency entries in the administration panel.