CVE-2024-2691 is a stored cross-site scripting vulnerability in the WP Event Manager plugin for WordPress, affecting all versions up to 3.1.43. The vulnerability is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user-supplied attributes in the 'events' shortcode. Authenticated attackers with contributor or higher privileges can inject arbitrary scripts that execute in the context of users viewing the injected pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, and privileges required at the contributor level.

Successful exploitation allows an authenticated user with contributor-level access or higher to inject and store malicious scripts within pages generated by the plugin's 'events' shortcode. These scripts execute in the browsers of users who view the affected pages, potentially leading to information disclosure or session hijacking. The vulnerability does not impact availability and requires user interaction (viewing the page). There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the 'events' shortcode. Monitor official wpeventmanager channels for updates and apply patches promptly once available.