CVE-2024-2459 describes a stored Cross-Site Scripting vulnerability in the UX Flat WordPress plugin (versions up to 4.4). The issue is due to improper neutralization of input during web page generation, specifically in the 'button' shortcode where user-supplied attributes are not properly sanitized or escaped. This allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript code that executes in the context of other users viewing the page, potentially leading to session hijacking, privilege escalation, or other script-based attacks. The CVSS 3.1 base score is 7.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who access those pages. This can lead to unauthorized actions performed on behalf of users, data theft, or disruption of site functionality. The vulnerability affects confidentiality, integrity, and availability of the affected WordPress site. There are no reports of active exploitation in the wild.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is released, restrict contributor-level permissions to trusted users only and consider disabling or removing the UX Flat plugin if possible to mitigate risk. Avoid granting contributor or higher privileges to untrusted users. Review and sanitize any content created via the 'button' shortcode to detect and remove malicious scripts.