The vulnerability CVE-2026-24558 in antoniobg ABG Rich Pins (<= 1.1) is a stored cross-site scripting issue caused by improper input sanitization during web page generation. This flaw enables attackers with at least low privileges and requiring user interaction to inject malicious scripts that can execute in the context of other users' browsers. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) reflects network attack vector, low attack complexity, low privileges required, user interaction needed, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to information disclosure, modification of data, or disruption of availability. The scope change indicates that the vulnerability affects resources beyond the initially vulnerable component. However, the impact is rated as low on confidentiality, integrity, and availability, and no known exploits have been reported.

Patch status is not yet confirmed — no official patch or remediation guidance is provided in the available data. Users should monitor the vendor's advisories for updates and apply any official fixes once released. Until then, limiting user privileges and exercising caution with user-generated content may reduce risk.