CVE-2024-3671 is a stored cross-site scripting vulnerability found in the Print-O-Matic plugin for WordPress, affecting all versions up to and including 2.1.10. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes within the plugin's 'print-me' shortcode, particularly the 'tag' attribute. This flaw allows authenticated users with contributor-level access or higher to inject arbitrary JavaScript code into pages. When other users access these pages, the malicious scripts execute in their browsers, potentially leading to session hijacking, unauthorized actions, or data theft. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and has a CVSS 3.1 base score of 6.4, reflecting a medium severity level. The attack vector is network-based with low attack complexity, requiring privileges but no user interaction. The scope is changed as the vulnerability affects other users beyond the attacker. No patches are currently linked, and no known exploits have been reported in the wild. The vulnerability was publicly disclosed on May 22, 2024, and was reserved in the CVE database on April 11, 2024. The plugin is widely used in WordPress environments, making this a relevant threat for many websites that rely on Print-O-Matic for printing functionality.

The primary impact of CVE-2024-3671 is the compromise of confidentiality and integrity for affected WordPress sites using the Print-O-Matic plugin. An attacker with contributor-level access can embed malicious scripts that execute in the context of other users’ browsers, potentially stealing session cookies, performing actions on behalf of users, or redirecting users to malicious sites. This can lead to account takeover, data leakage, or further exploitation within the site. Although availability is not directly impacted, the trustworthiness and security posture of the affected website can be severely damaged. For organizations, this vulnerability could result in reputational harm, loss of customer trust, and compliance issues if sensitive user data is exposed. Since exploitation requires authenticated access, the risk is somewhat mitigated by the need for an attacker to have at least contributor privileges, but insider threats or compromised accounts increase the risk. The vulnerability affects all sites using the vulnerable versions of Print-O-Matic, which may include a broad range of industries and geographies relying on WordPress for content management.

Organizations should immediately verify if they are using the Print-O-Matic plugin version 2.1.10 or earlier and plan to update to a patched version once available. In the absence of an official patch, administrators should consider disabling the plugin or removing the 'print-me' shortcode usage to prevent exploitation. Restrict contributor-level access strictly and audit user roles to minimize the risk of malicious insiders or compromised accounts. Implement Web Application Firewalls (WAFs) with rules to detect and block typical XSS payloads targeting the 'tag' attribute in the shortcode. Employ Content Security Policy (CSP) headers to restrict script execution sources, reducing the impact of injected scripts. Regularly scan the website for injected scripts or unusual content in pages using the shortcode. Educate content contributors about safe input practices and monitor logs for suspicious activity. Finally, maintain a robust incident response plan to quickly address any signs of exploitation.