CVE-2024-58344 is a persistent cross-site scripting vulnerability in Carbon Forum 5.9.0. Authenticated administrators can inject malicious JavaScript code through the Forum Name field in the dashboard settings. This stored XSS flaw allows execution of attacker-controlled scripts in the browsers of all users visiting the forum, which can be leveraged for session hijacking and data theft. The vulnerability requires administrative privileges and user interaction to trigger the malicious payload. The CVSS 4.0 score is 5.1 (medium severity). No vendor-provided patch or official remediation information is currently available.

Successful exploitation allows an attacker with administrative access to inject persistent malicious scripts that execute in the context of forum users' browsers. This can lead to session hijacking, theft of sensitive data, and potentially further compromise of user accounts. The impact is limited by the requirement for attacker administrative privileges and user interaction to trigger the payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity related to forum settings. Consider sanitizing or validating input fields at the application level as a temporary mitigation if feasible.