CVE-2024-2392 is a stored cross-site scripting vulnerability (CWE-79) in the Blocksy Companion plugin for WordPress, specifically in the Newsletter widget. The flaw arises from improper neutralization of user-supplied input during web page generation, allowing authenticated attackers with contributor or higher privileges to inject arbitrary scripts. These scripts execute in the context of users viewing the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to and including 2.0.31. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity without availability impact.

An attacker with contributor-level or higher permissions can exploit this vulnerability to inject and store malicious scripts in the Newsletter widget. When other users access the affected pages, these scripts execute in their browsers, potentially leading to partial confidentiality and integrity compromise. There is no direct impact on system availability. This could facilitate actions such as session hijacking or unauthorized actions performed in the context of the victim user.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level permissions carefully and consider disabling or removing the Newsletter widget in the Blocksy Companion plugin to prevent exploitation.