CVE-2024-2457 is a stored cross-site scripting vulnerability in the Modal Window – create popup modal window WordPress plugin (versions up to 5.3.8). The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and output escaping of user-supplied shortcode attributes. Authenticated attackers with contributor-level or higher privileges can inject arbitrary web scripts that execute in the context of users visiting the compromised pages. This vulnerability is categorized under CWE-79 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).

Successful exploitation allows an authenticated user with contributor or higher permissions to perform stored cross-site scripting attacks. This can lead to partial confidentiality and integrity loss, such as theft of user session data or manipulation of page content when other users access the injected pages. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or removing the vulnerable plugin if possible. Monitor for plugin updates from the vendor that address this vulnerability.