CVE-2024-0256 is a stored cross-site scripting vulnerability in the cifi Starbox – the Author Box for Humans WordPress plugin. The issue is due to improper neutralization of input during web page generation (CWE-79), specifically in the Profile Display Name and Social Settings fields. Authenticated attackers with subscriber or higher privileges can inject malicious scripts that persist and execute in the context of other users viewing the injected pages. The vulnerability affects all versions up to 3.4.8. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and limited confidentiality and integrity impact.

An attacker with subscriber-level or higher access can inject persistent malicious scripts into pages rendered by the Starbox plugin. These scripts execute in the context of other users who view the affected pages, potentially leading to theft of session tokens, user impersonation, or other client-side impacts. The vulnerability does not impact availability. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting subscriber-level user input in the Profile Display Name and Social Settings fields or applying manual input sanitization and output escaping as a temporary mitigation. Monitor official cifi or WordPress plugin channels for updates and apply patches promptly once available.