CVE-2024-2295 is a stored cross-site scripting vulnerability in the f1logic Contact Form Manager WordPress plugin (versions up to 1.6.1). The issue arises from improper neutralization of user-supplied attributes in the [xyz-cfm-form] shortcode, allowing authenticated contributors or higher to inject arbitrary web scripts. These scripts execute in the context of any user viewing the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability requires authenticated access with contributor or higher privileges and does not require user interaction beyond visiting the injected page.

An attacker with contributor-level or higher permissions can inject persistent malicious scripts into pages using the vulnerable shortcode. This can lead to unauthorized actions performed in the context of other users viewing the page, such as session hijacking or defacement. The vulnerability does not impact availability and has limited confidentiality and integrity impact as per the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Contact Form Manager plugin if feasible to prevent exploitation.