CVE-2024-2958 is a stored cross-site scripting vulnerability (CWE-79) in the SVS Pricing Tables plugin for WordPress, affecting all versions up to and including 1.0.4. The issue arises from improper neutralization of input during web page generation, specifically in pricing table settings. Authenticated attackers with administrator privileges can inject malicious scripts that execute in the context of users visiting the compromised pages. This vulnerability only impacts multi-site WordPress installations or those with unfiltered_html disabled. No known exploits are reported in the wild, and no official patch or fix has been documented yet.

Successful exploitation allows an attacker with administrator-level access to inject and execute arbitrary JavaScript in the context of users viewing the affected pages. This can lead to information disclosure or session hijacking limited to the scope of the affected site. The vulnerability does not affect availability and requires high privileges and no user interaction. It is limited to multi-site or restricted HTML configurations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider disabling or removing the SVS Pricing Tables plugin in multi-site or unfiltered_html-disabled environments. Monitor vendor channels for updates and apply patches promptly once available.