CVE-2024-3666 is a stored cross-site scripting vulnerability in the wpopal Opal Estate Pro – Property Management and Submission WordPress plugin, affecting all versions up to and including 1.7.6. The vulnerability is due to improper neutralization of alternate XSS syntax (CWE-87) in the agent latitude and longitude parameters. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute when a user accesses the injected page, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at low level, no user interaction needed, and a scope change with low confidentiality and integrity impact but no availability impact.

An attacker with contributor or higher privileges can store malicious scripts in the latitude and longitude fields, which execute in the context of users viewing the affected pages. This can lead to partial confidentiality and integrity compromise of user data or sessions. There is no direct impact on system availability. The vulnerability requires authenticated access, limiting the attack surface to users with at least contributor rights.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider additional input validation or output escaping controls at the application or web server level. Monitor for plugin updates from wpopal and apply official patches promptly when released.