CVE-2024-1445 is a stored cross-site scripting vulnerability in the malihu Page scroll to id WordPress plugin. The flaw arises from improper neutralization of input during web page generation, specifically in the handling of shortcode attributes. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript code that executes in the context of users viewing the compromised pages. This vulnerability affects all versions up to and including 1.7.8. The CVSS 3.1 base score is 6.4 (medium severity), with attack vector network, low attack complexity, privileges required at the low level, no user interaction, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to partial confidentiality and integrity impacts, such as theft of session tokens or manipulation of page content. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or removing the plugin if possible. Monitor for plugin updates from the vendor that address this vulnerability.