CVE-2024-58344 is a persistent cross-site scripting vulnerability affecting Carbon Forum 5.9.0. It arises from improper neutralization of input during web page generation, specifically in the Forum Name field accessible to authenticated administrators. Malicious JavaScript injected here can execute in the context of any user visiting the forum, potentially leading to session hijacking and data theft. The vulnerability has a CVSS 4.0 base score of 5.1 (medium severity) and does not require user privileges beyond admin access. No official patch or vendor advisory is currently available, and no exploits are known in the wild.

An attacker with administrator privileges can inject persistent malicious scripts into the Forum Name field, which execute in the browsers of all users visiting the forum. This can lead to session hijacking and theft of sensitive user data. The vulnerability affects only version 5.9.0 of Carbon Forum and requires admin-level access to exploit. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted personnel only and consider monitoring or sanitizing inputs in the Forum Name field if possible. Avoid visiting or sharing links to forums running the affected version with untrusted users.