CVE-2024-3338 is a stored cross-site scripting vulnerability in the Colibri Page Builder WordPress plugin by extendthemes. The flaw exists due to improper neutralization of input in the image alt attribute, allowing authenticated users with author-level privileges or higher to inject arbitrary JavaScript code. This code executes in the context of users viewing the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 1.0.262. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, low privileges required, and user interaction needed.

An attacker with author-level access or higher can inject malicious scripts into pages via the image alt attribute, which execute when other users access those pages. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of page content. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict author-level access to trusted users only and consider monitoring for suspicious activity related to page content modifications. Avoid granting author or higher privileges to untrusted users. Review and sanitize user inputs where possible.