CVE-2024-1791 is a stored cross-site scripting vulnerability in the CodeMirror Blocks WordPress plugin (versions up to 1.2.4). It results from improper neutralization of input during web page generation (CWE-79). Authenticated users with contributor or higher privileges can inject arbitrary web scripts via the Code Mirror block, which execute when other users access the injected pages. The vulnerability has a CVSS 3.1 score of 6.4, reflecting network attack vector, low attack complexity, and privileges required at the contributor level without user interaction. No vendor patch or official fix has been documented.

Successful exploitation allows an authenticated contributor or higher to inject and execute arbitrary JavaScript in the context of the affected WordPress site. This can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation, but does not affect availability. The vulnerability requires authenticated access, limiting exposure to trusted users with contributor or higher roles. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the CodeMirror Blocks plugin if possible. Monitor for updates from the vendor or plugin author regarding patches or mitigations.