CVE-2024-2328 is a stored cross-site scripting vulnerability (CWE-79) in the Real Media Library: Media Library Folder & File Manager WordPress plugin by devowl. The issue is due to improper neutralization of input during web page generation, specifically in the image title and alt text fields. Authenticated users with author or higher privileges can inject arbitrary web scripts that execute when other users access the injected content. This vulnerability affects all versions up to and including 4.22.11. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the author level, no user interaction, and partial impact on confidentiality and integrity without availability impact. No patch or vendor advisory is provided in the data, and the plugin is not a cloud service.

Successful exploitation allows an authenticated user with author-level access or higher to inject persistent malicious scripts via image metadata fields. These scripts execute in the context of other users viewing the affected pages, potentially leading to unauthorized actions or data disclosure limited to confidentiality and integrity impacts. There is no impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit author-level access to trusted users only and consider removing or sanitizing image metadata fields manually. Monitor for updates from the plugin vendor or WordPress security channels for an official patch or mitigation instructions.