CVE-2024-2337 is a stored cross-site scripting vulnerability in the Easy Testimonials WordPress plugin (versions up to 3.9.5). It arises from improper input sanitization and output escaping of user-supplied attributes in the 'testimonials_grid' shortcode. Authenticated users with contributor or higher privileges can inject arbitrary web scripts that execute in the context of any user viewing the injected page. This vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (medium severity). No patch or remediation details are currently available from the vendor or other sources.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts that execute in the browsers of users visiting the affected pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or unauthorized actions performed on behalf of users. There is no indication of availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the 'testimonials_grid' shortcode. Monitor official vendor channels for updates and apply patches promptly once released.