CVE-2024-0657 is a stored cross-site scripting vulnerability (CWE-79) in the Internal Link Juicer: SEO Auto Linker for WordPress plugin. The flaw exists due to improper neutralization of input in admin settings, allowing authenticated administrators to inject malicious scripts. These scripts execute in the context of users visiting the injected pages, affecting multi-site installations or sites with unfiltered_html disabled. The vulnerability requires high privileges (administrator access) and has a CVSS 3.1 base score of 4.4, reflecting limited attack complexity and impact confined to confidentiality and integrity.

An authenticated attacker with administrator privileges can inject arbitrary web scripts via plugin admin settings. These scripts execute in the browsers of users who visit the injected pages, potentially leading to confidentiality and integrity impacts such as session hijacking or unauthorized actions. The vulnerability does not affect availability and requires high privileges and specific WordPress configurations (multi-site or unfiltered_html disabled). No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict administrator access to trusted users only and review plugin settings carefully. Consider disabling or limiting the use of the Internal Link Juicer plugin on multi-site installations or where unfiltered_html is disabled. Monitor vendor channels for updates and apply official fixes once released.