CVE-2024-2089 is a stored cross-site scripting vulnerability in the doublesharp Remote Content Shortcode WordPress plugin (up to version 1.5). It arises from improper neutralization of user-supplied input in the 'remote_content' shortcode attributes, allowing authenticated contributors or higher to inject arbitrary web scripts. These scripts execute in the context of users visiting the injected pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, and privileges required at the contributor level.

The vulnerability allows authenticated users with contributor or higher privileges to inject persistent malicious scripts into WordPress pages. When other users view these pages, the scripts execute in their browsers, potentially leading to information disclosure or other client-side impacts. There is no indication of impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions carefully and consider disabling or removing the Remote Content Shortcode plugin if possible. Monitor vendor channels for updates and apply patches promptly once released.