CVE-2024-1959 is a stored cross-site scripting vulnerability in the Social Sharing Plugin – Social Warfare for WordPress, affecting all versions up to 4.4.6.1. The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user-supplied attributes in the 'socialWarfare' shortcode. Authenticated users with contributor-level or higher permissions can exploit this to inject arbitrary web scripts that execute in the context of any user viewing the injected page. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, and limited privileges required.

An attacker with contributor-level or higher permissions can inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to theft of session tokens, user impersonation, or other actions permitted by the victim's browser context. There is no indication of impact on availability. The vulnerability does not appear to be exploited in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or removing the Social Warfare plugin if possible. Monitor official vendor channels for updates or patches addressing this vulnerability.