CVE-2024-0658 is a stored cross-site scripting vulnerability in the Insert PHP Code Snippet plugin for WordPress, affecting all versions up to and including 1.3.4. The vulnerability occurs due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the user's name on the insert-php-code-snippet-manage page. Exploitation requires authenticated administrator-level access and affects multi-site WordPress installations or those with unfiltered_html disabled. Successful exploitation allows injection of arbitrary web scripts that execute when the affected page is viewed.

An authenticated attacker with administrator privileges can inject malicious scripts that execute in the context of the affected site, potentially leading to limited confidentiality and integrity impacts such as session hijacking or defacement. The vulnerability does not affect availability and requires high privileges and specific configuration (multi-site or unfiltered_html disabled) to be exploitable.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, limit administrator access to trusted users only and consider disabling or removing the Insert PHP Code Snippet plugin in multi-site environments or where unfiltered_html is disabled to reduce risk.