CVE-2024-2732 is a stored cross-site scripting vulnerability in the Themify Shortcodes plugin for WordPress, specifically affecting the 'themify_post_slider' shortcode in all versions up to 2.0.8. The issue stems from improper neutralization of input during web page generation, allowing authenticated users with contributor-level access or higher to inject malicious scripts via shortcode attributes. These scripts execute in the context of users viewing the injected pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 5.4 (medium), with attack vector network, low attack complexity, privileges required at the low level, no user interaction needed, and impacts on confidentiality and integrity but not availability.

An attacker with contributor-level or higher privileges can inject persistent malicious scripts into pages via the vulnerable shortcode. When other users access these pages, the injected scripts execute in their browsers, potentially leading to unauthorized actions such as data theft or session compromise. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Themify Shortcodes plugin if possible to mitigate risk.