CVE-2024-2287 is a stored cross-site scripting vulnerability in the Knight Lab Timeline WordPress plugin (versions up to 3.9.3.3). The issue stems from improper neutralization of input during web page generation, specifically insufficient sanitization and output escaping of user-supplied shortcode attributes. Authenticated attackers with contributor or higher privileges can exploit this to inject arbitrary JavaScript that executes in the context of users visiting the compromised page. This can lead to limited confidentiality and integrity impacts without affecting availability.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts into pages using the plugin's shortcodes. These scripts execute in the browsers of users who view the injected pages, potentially leading to information disclosure or manipulation within the scope of the affected site. The CVSS vector indicates network attack vector, low attack complexity, privileges required at low level, no user interaction needed, and a scope change, with limited confidentiality and integrity impact and no availability impact.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is released, restrict contributor-level permissions to trusted users only and consider disabling or removing the Knight Lab Timeline plugin if feasible to reduce exposure.