CVE-2024-0621 is a stored cross-site scripting vulnerability in the Simple Share Buttons Adder plugin for WordPress, present in all versions up to and including 8.4.11. The vulnerability results from improper neutralization of input during web page generation (CWE-79), allowing authenticated administrators to inject arbitrary web scripts via the plugin's admin settings. This issue affects multi-site installations and installations with unfiltered_html disabled, enabling script execution in pages viewed by users. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges but no user interaction.

An authenticated attacker with administrator-level permissions can inject malicious scripts that execute in the context of users visiting affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or defacement, but does not affect availability. The vulnerability is limited to multi-site or restricted unfiltered_html environments, reducing the attack surface.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict administrator access to trusted users only and consider disabling or removing the Simple Share Buttons Adder plugin in multi-site or unfiltered_html-disabled environments to mitigate risk.