The vulnerability CVE-2024-1409 affects the ProfilePress WordPress plugin, specifically in the [reg-select-role] shortcode. Due to improper neutralization of input during web page generation (CWE-79), authenticated users with contributor-level permissions or higher can inject stored cross-site scripting payloads. This occurs because the plugin fails to properly sanitize and escape user-supplied attributes, allowing arbitrary script injection that executes in the context of other users viewing the injected page. The CVSS 3.1 score is 6.4 (medium), with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts on confidentiality and integrity but not availability. No known exploits in the wild have been reported. The plugin is not a cloud service, and no patch or official fix information is currently available.

An attacker with contributor-level or higher permissions can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who access the affected pages. This can lead to unauthorized disclosure of information and modification of data within the context of the vulnerable site. The impact does not include denial of service. The vulnerability affects confidentiality and integrity but not availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions carefully and consider disabling or limiting use of the [reg-select-role] shortcode if possible. Monitor vendor channels for updates and apply patches promptly once released.