CVE-2024-2303 is a stored cross-site scripting vulnerability (CWE-79) in the Easy Textillate plugin for WordPress, affecting all versions up to and including 2.01. The issue arises from improper neutralization of user-supplied input in the 'textillate' shortcode, allowing authenticated users with contributor or higher privileges to inject arbitrary JavaScript code. This code executes in the context of any user who accesses the compromised page, potentially leading to session hijacking or other client-side impacts. The vulnerability requires authentication with limited privileges and does not require user interaction beyond page access.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts into pages, which execute in the browsers of users viewing those pages. This can lead to information disclosure or session compromise of affected users. There is no indication of impact on availability or server-side integrity. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.4.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Easy Textillate plugin if possible to prevent exploitation.