CVE-2024-1946 is a stored cross-site scripting vulnerability in the Genesis Blocks plugin for WordPress, affecting all versions up to and including 3.1.2. The issue arises from improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of block content. Authenticated attackers with contributor-level access or higher can inject arbitrary scripts that execute in the context of users viewing the compromised pages. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (medium severity). No patch or official fix information is currently available.

Successful exploitation allows authenticated users with contributor or higher privileges to inject and execute arbitrary JavaScript in the context of other users viewing the affected pages. This can lead to information disclosure or actions performed on behalf of users without their consent. The vulnerability does not impact availability and requires user interaction (viewing the injected page). No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider monitoring or reviewing content submitted by contributors for suspicious scripts. Avoid granting unnecessary privileges to reduce risk.