CVE-2024-2477 is a stored cross-site scripting vulnerability in the advancedcoding wpDiscuz WordPress plugin affecting versions up to 7.6.15. The flaw is due to improper neutralization of input in the 'Alternative Text' field of uploaded images, allowing authenticated users with author-level permissions or higher to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, required privileges at the author level, no user interaction, and impacts on confidentiality and integrity but not availability.

An authenticated attacker with author-level access or higher can exploit this vulnerability to inject malicious scripts into pages via the 'Alternative Text' field of uploaded images. These scripts execute in the browsers of users who view the affected pages, potentially compromising user data confidentiality and integrity. There is no indication of impact on system availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level access to trusted users only and consider disabling image uploads or sanitizing inputs at the application or web server level as temporary mitigations. Monitor vendor channels for updates and apply patches promptly once released.