CVE-2024-2304 is a stored cross-site scripting vulnerability in the Animated Headline WordPress plugin by anshuln90. It affects all versions up to and including 4.0. The flaw is due to improper neutralization of input during web page generation, specifically insufficient sanitization and output escaping of user-supplied attributes in the 'animated-headline' shortcode. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript that executes in the context of users viewing the injected pages.

An attacker with contributor-level or higher permissions can inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who view the compromised pages, potentially leading to session hijacking, unauthorized actions, or other client-side impacts. The vulnerability does not affect availability and requires authentication, but it can compromise confidentiality and integrity of user sessions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level permissions to trusted users only and consider disabling or removing the Animated Headline plugin if possible. Monitor official sources for updates or patches addressing this vulnerability.