CVE-2024-2968 is a stored cross-site scripting vulnerability (CWE-79) in the WP-Eggdrop plugin for WordPress, affecting all versions up to and including 0.1. The vulnerability arises from insufficient sanitization and escaping of input in admin settings, enabling authenticated administrators to inject arbitrary scripts. This flaw affects multi-site WordPress setups and installations with unfiltered_html disabled, potentially allowing script execution in the context of other users viewing the injected pages. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, scope changed, and low confidentiality and integrity impact.

An attacker with administrator-level access can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or defacement within the affected WordPress multi-site environments. The vulnerability does not affect availability and requires high privileges and a multi-site or restricted HTML configuration to be exploitable.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, restrict administrator access to trusted users only and consider disabling or avoiding use of the WP-Eggdrop plugin in multi-site environments or where unfiltered_html is disabled until a fix is released.