CVE-2024-1852 is a stored cross-site scripting vulnerability in the WP-Members Membership Plugin for WordPress, affecting all versions up to and including 3.4.9.2. The vulnerability is triggered by malicious input in the X-Forwarded-For HTTP header, which is not properly sanitized or escaped before being rendered on the edit users page. This allows unauthenticated attackers to inject and execute arbitrary JavaScript in the context of users viewing that page. The vulnerability was partially addressed in version 3.4.9.2 and fully remediated in version 3.4.9.3.

Successful exploitation can lead to the execution of arbitrary scripts in the context of authenticated users accessing the edit users page, potentially resulting in session hijacking, defacement, or other malicious actions limited to the privileges of the affected users. There is no indication of impact on availability or system integrity beyond the XSS effects.

Users of the WP-Members Membership Plugin should upgrade to version 3.4.9.3 or later, where the vulnerability is fully patched. The partial fix in version 3.4.9.2 does not fully mitigate the issue. No other mitigations are indicated by the vendor advisory. Patch status is confirmed by the plugin version history and advisory details.