CVE-2024-1450 describes a stored cross-site scripting vulnerability in the 3uu Shariff Wrapper WordPress plugin, affecting all versions up to 4.6.10. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and output escaping of user-supplied shortcode attributes like 'align'. Authenticated attackers with contributor-level or higher privileges can exploit this to inject arbitrary JavaScript that executes in the context of users viewing the compromised pages. This can lead to information disclosure and limited integrity impact. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity) with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows authenticated users with contributor or higher permissions to inject stored malicious scripts into pages via the 'shariff' shortcode attributes. These scripts execute in the browsers of users who view the infected pages, potentially leading to information disclosure and limited integrity compromise. There is no indication of availability impact. The vulnerability does not require user interaction and can be triggered remotely over the network.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's official channels for updates and apply any forthcoming patches promptly. Until a fix is released, restrict contributor-level permissions to trusted users only and consider disabling or removing the Shariff Wrapper plugin if feasible to reduce risk.