CVE-2024-3672 is a stored cross-site scripting vulnerability in the BA Book Everything WordPress plugin affecting all versions up to 1.6.8. The issue stems from improper neutralization of input in the 'all-items' shortcode, specifically in user-supplied attributes like 'classes'. Authenticated users with contributor-level privileges or higher can inject arbitrary JavaScript code that executes in the context of other users viewing the injected page. This vulnerability can lead to information disclosure or session hijacking but does not impact availability. CVE-2024-32576 is likely a duplicate of this issue. No patch or official fix has been documented yet.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to theft of session tokens or other sensitive information. The vulnerability does not affect system availability. The CVSS 3.1 base score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the BA Book Everything plugin if possible. Monitor for plugin updates that address this vulnerability.