CVE-2024-2334 is a stored cross-site scripting vulnerability in the Template Kit – Import WordPress plugin by envato, affecting all versions up to and including 1.0.14. The flaw is due to improper sanitization and escaping of uploaded template files, which allows authenticated users with author or higher privileges to inject arbitrary web scripts. These scripts persist in the system and execute when other users view the compromised pages, potentially leading to session hijacking, defacement, or other client-side attacks. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges at the author level, no user interaction, and partial confidentiality and integrity impact without availability impact.

An attacker with author-level access can exploit this vulnerability to inject malicious scripts into pages via the template upload feature. This can lead to stored XSS attacks affecting users who visit the injected pages, potentially compromising user sessions or performing unauthorized actions within the context of the victim's browser. The impact is limited to confidentiality and integrity with no direct availability impact. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict author-level access to trusted users only and consider disabling the template upload functionality if feasible. Applying strict input validation and output escaping on the server side is recommended once a patch is available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.