CVE-2024-29815 is a stored cross-site scripting vulnerability (CWE-79) in the WP Change Email Sender plugin by Aminur Islam. The vulnerability occurs due to improper neutralization of input during web page generation, enabling an attacker to inject and store malicious scripts that execute in the context of users with high privileges. This affects versions prior to 1.3.0. The CVSS 3.1 base score is 5.9, reflecting network attack vector, low attack complexity, required privileges at high level, and user interaction needed, with partial impact on confidentiality, integrity, and availability. No patch or official remediation has been published yet.

The vulnerability allows stored XSS attacks that can lead to limited compromise of confidentiality, integrity, and availability of the affected system. Because exploitation requires high privileges and user interaction, the risk is moderated but still significant for privileged users. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should limit plugin usage to trusted administrators and avoid exposing the plugin interface to untrusted users. Monitor vendor channels for updates and apply patches promptly once released.