CVE-2024-2794 describes a stored cross-site scripting vulnerability (CWE-79) in the Gutenberg Block Editor Toolkit – EditorsKit WordPress plugin. The flaw exists in the handling of the 'editorskit' shortcode, where user input is not properly sanitized or escaped before being output in web pages. Authenticated attackers with contributor or higher privileges can exploit this to inject arbitrary JavaScript that executes in the context of users viewing the compromised pages. This vulnerability affects all plugin versions up to and including 1.40.4. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at the contributor level, no user interaction needed, and partial impact on confidentiality and integrity but no impact on availability.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to partial disclosure of information and modification of data within the affected site context. There is no impact on system availability. The vulnerability does not require user interaction beyond viewing the injected page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the 'editorskit' shortcode if feasible. Monitor for plugin updates from the vendor addressing this vulnerability.