CVE-2024-3023 is a stored cross-site scripting vulnerability in the AnnounceKit plugin for WordPress, present in all versions up to 2.0.9. The issue arises from insufficient input sanitization and output escaping in admin settings, allowing authenticated administrators to inject arbitrary scripts. This vulnerability specifically impacts multi-site WordPress installations or those where the unfiltered_html capability is disabled. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and partial impact on confidentiality and integrity without affecting availability.

An attacker with administrator-level permissions can exploit this vulnerability to inject malicious scripts that execute in the context of other users viewing the injected pages. This can lead to partial disclosure of confidential information and integrity compromise of affected pages. The vulnerability does not impact availability. Since exploitation requires high privileges and affects specific WordPress configurations, the overall risk is medium.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisories for updates. In the meantime, restrict administrator access to trusted users only and consider limiting multi-site usage or enabling unfiltered_html capability if appropriate. Avoid exposing affected admin settings to untrusted users. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.