CVE-2024-2793 is a stored cross-site scripting vulnerability in the Atarim WordPress plugin (versions up to 3.30). The flaw arises from improper neutralization of input during web page generation, specifically in the handling of comments. This allows unauthenticated attackers to inject arbitrary scripts that execute in the context of users who access the compromised pages. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with scope change.

Successful exploitation enables an unauthenticated attacker to execute arbitrary scripts in the browsers of users who visit the injected pages. This can lead to partial confidentiality and integrity impacts, such as theft of sensitive information or manipulation of content within the affected site context. There is no indication of availability impact. The vulnerability affects all versions up to and including 3.30 of the Atarim plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Atarim plugin if feasible, or applying any recommended temporary mitigations from the vendor. Monitor official sources for updates regarding patches or fixes.