CVE-2024-1787 is a stored cross-site scripting vulnerability in the Contests by Rewards Fuel WordPress plugin, affecting all versions up to and including 2.0.64. The vulnerability occurs because the 'update_rewards_fuel_api_key' parameter is not properly sanitized or escaped, allowing authenticated users with contributor-level permissions or higher to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable parameter. This can lead to unauthorized script execution in the context of other users viewing the affected pages, potentially compromising user sessions or performing actions on behalf of users. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access and above to trusted users only. Monitor plugin updates from Rewards Fuel for a security patch addressing this vulnerability.