The vulnerability identified as CVE-2024-34423 in the phpbits Forty Four – 404 Plugin for WordPress is a stored cross-site scripting (CWE-79) issue. It occurs due to improper input sanitization during web page generation, which can allow an attacker with high privileges and requiring user interaction to inject malicious scripts. The vulnerability affects all versions up to 1.4 of the plugin. The CVSS 3.1 base score is 5.9, reflecting network attack vector, low attack complexity, high privileges required, user interaction required, and impacts on confidentiality, integrity, and availability at a low level. No patch or official remediation has been disclosed by the vendor as of the published date.

Successful exploitation of this vulnerability could allow an attacker with high privileges to inject and execute malicious scripts within the context of the affected WordPress plugin, potentially leading to limited confidentiality, integrity, and availability impacts. However, exploitation requires user interaction and elevated privileges, which limits the scope and ease of attack. There are no known active exploits in the wild currently.

As no official patch or remediation guidance has been provided by the vendor, users should monitor the vendor's advisory channels for updates. Until a fix is available, restricting high-privilege access to the plugin and minimizing user interaction with untrusted content may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.