CVE-2024-3340 is a stored cross-site scripting vulnerability (CWE-79) in the Colibri Page Builder plugin for WordPress, specifically in the 'colibri-gallery-slideshow' shortcode. Due to inadequate input sanitization and output escaping, authenticated users with contributor-level privileges or higher can inject arbitrary JavaScript code into pages. This code executes in the context of any user who views the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all plugin versions up to and including 1.0.272. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the contributor level.

An attacker with contributor-level access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to information disclosure or user session compromise. The impact is limited by the requirement for authenticated contributor-level access and the absence of known active exploitation. There is no indication of denial of service or system-level compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or avoiding use of the 'colibri-gallery-slideshow' shortcode. Monitor for updates from the vendor (extendthemes) and apply any official patches promptly once available.