CVE-2024-1985 is a stored cross-site scripting vulnerability in the Simple Membership plugin for WordPress (wpinsider-1). The issue stems from improper neutralization of input in the 'Display Name' parameter, allowing attackers to inject arbitrary web scripts that execute when a user accesses the injected page. The vulnerability affects all versions up to 4.4.2. Successful exploitation requires user interaction (social engineering) to log in and trigger the malicious script. The CVSS 3.1 base score is 4.7, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, and limited confidentiality and integrity impact.

An unauthenticated attacker can inject stored malicious scripts via the 'Display Name' parameter, which execute in the context of users who view the affected pages after logging in. This could lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed with the victim's privileges. The impact is limited by the requirement for social engineering and user login to trigger the payload. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious about accepting or displaying untrusted input in the 'Display Name' field. Applying strict input validation and output escaping on this parameter can mitigate the risk. Monitor vendor channels for updates regarding patches or official fixes.