CVE-2024-3773: CWE-79 Cross-Site Scripting (XSS) in LiveJournal Shortcode

CVE-2024-3773 is a stored Cross-Site Scripting (XSS) vulnerability in the LiveJournal Shortcode WordPress plugin through version 1.1.1. The plugin fails to validate and escape certain shortcode attributes before rendering them in posts or pages, allowing users with contributor or higher privileges to inject malicious scripts that persist in the content. This can lead to cross-site scripting attacks impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 5.9 (medium severity). No patch or official remediation guidance has been published as of the data provided.

Exploitation of this vulnerability allows users with contributor or higher privileges to perform stored XSS attacks, potentially leading to unauthorized script execution in the context of other users viewing the affected pages or posts. This can result in partial compromise of confidentiality, integrity, and availability of the affected WordPress site. However, exploitation requires at least contributor-level access, limiting the attack surface to authenticated users with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider removing or disabling the LiveJournal Shortcode plugin if possible to mitigate risk.