CVE-2024-2936 is a stored cross-site scripting vulnerability in the Sydney Toolbox WordPress plugin (versions up to 1.26). The issue occurs due to improper neutralization of input during web page generation, specifically in the _id attribute of widgets. Authenticated attackers with contributor-level permissions or above can exploit this to inject arbitrary scripts that execute in the context of users viewing the compromised pages. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity.

Successful exploitation allows an attacker with contributor-level access to inject persistent malicious scripts into pages, potentially leading to unauthorized actions or data exposure for users who view those pages. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates and consider restricting contributor-level access until a fix is released. Applying strict input validation and output escaping as a temporary measure may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.