CVE-2024-2123 describes a stored cross-site scripting (CWE-79) vulnerability in the Ultimate Member plugin for WordPress, affecting all versions up to and including 2.8.3. The flaw arises from improper neutralization of input during web page generation, allowing unauthenticated attackers to inject arbitrary scripts via multiple parameters. These scripts execute in the context of users visiting the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact on confidentiality and integrity but not availability. There is no vendor advisory or patch information provided in the input data.

Successful exploitation allows unauthenticated attackers to perform stored cross-site scripting attacks, which can lead to the execution of arbitrary scripts in the context of users visiting the affected pages. This can compromise user confidentiality and integrity by stealing session tokens, defacing content, or performing actions on behalf of users. Availability is not impacted. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected plugin features or applying custom input sanitization and output escaping as a temporary mitigation. Monitor the vendor's official channels for updates and patches.