CVE-2024-3021 is a stored cross-site scripting vulnerability in the Mhr Post Ticker WordPress plugin (versions up to 1.1). It arises from insufficient input sanitization and output escaping of the Header Title value. Authenticated attackers with administrator privileges on multi-site WordPress installations or where unfiltered_html is disabled can inject arbitrary scripts. These scripts execute in the context of users visiting the injected pages, potentially leading to limited confidentiality and integrity impacts. The vulnerability has a CVSS 3.1 base score of 4.4 (medium severity), with attack vector network, high attack complexity, high privileges required, no user interaction, and scope changed.

An attacker with administrator-level access can inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts such as session hijacking or content manipulation. The vulnerability does not affect standalone installations or those with unfiltered_html enabled. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary mitigation, restrict administrator access to trusted users only and consider disabling or removing the Mhr Post Ticker plugin on multi-site installations or where unfiltered_html is disabled until a fix is released.