CVE-2024-2956 is a stored cross-site scripting vulnerability (CWE-79) in the Simple Ajax Chat – Add a Fast, Secure Chat Box WordPress plugin. It arises from insufficient input sanitization and output escaping in admin settings, allowing authenticated users with administrator-level permissions to inject arbitrary web scripts. These scripts execute when any user accesses the injected page. The issue affects multi-site WordPress installations or those with unfiltered_html disabled, across all versions up to and including 20231101. The vulnerability has a CVSS 3.1 base score of 4.4, indicating medium severity. No patch or vendor advisory is currently available, and no exploits are known in the wild.

An authenticated attacker with administrator privileges can inject malicious scripts into the plugin's admin settings, leading to stored XSS that executes in users' browsers when they visit the affected pages. This can result in limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed in the context of the victim user. The vulnerability does not affect availability and requires high privileges and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or avoiding use of the plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates and apply patches promptly once released.