CVE-2024-2293 is a stored cross-site scripting vulnerability (CWE-79) in the geminilabs Site Reviews WordPress plugin. It affects all versions up to 6.11.4 due to insufficient input sanitization and output escaping of the user display name. Authenticated attackers with subscriber or higher privileges can inject arbitrary scripts that execute when users access the injected pages. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity with no availability impact.

An attacker with subscriber-level access or higher can inject malicious scripts into pages via the user display name field. These scripts execute in the context of other users viewing the affected pages, potentially leading to session hijacking, data theft, or other unauthorized actions impacting confidentiality and integrity. There is no direct impact on system availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor for suspicious activity related to user display names. Avoid visiting or sharing links to pages that may contain injected scripts. Apply standard WordPress security best practices to limit exposure.