CVE-2024-2500 is a stored cross-site scripting vulnerability in the ColorMag WordPress theme (versions up to 3.1.6). The issue is due to improper neutralization of input during web page generation (CWE-79), specifically insufficient sanitization and escaping of the Display Name field. Authenticated attackers with contributor-level privileges or higher can exploit this to inject arbitrary JavaScript that executes in the context of other users viewing the injected pages. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the contributor level.

Successful exploitation allows an attacker with contributor-level access to execute arbitrary scripts in the browsers of users who visit the injected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation. There is no direct impact on availability. No known exploits are reported in the wild at this time.

No official patch or fix is currently referenced in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider applying additional input validation or output escaping via custom code or security plugins to mitigate the risk.