CVE-2024-3827 is a stored cross-site scripting vulnerability in the Brainstorm Force Spectra Pro WordPress plugin affecting all versions up to and including 1.1.4. The issue arises from insufficient input sanitization and output escaping of block IDs, allowing authenticated users with contributor or higher privileges to inject arbitrary JavaScript code into pages. This code executes when any user accesses the compromised page, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, and privileges required. No patch or official fix has been documented yet.

An attacker with contributor-level or higher access can inject malicious scripts into pages via block IDs. These scripts execute in the context of users viewing the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability does not affect availability and requires authenticated access, limiting the attack scope. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider additional input validation or security plugins that can detect or block XSS payloads. Monitor official Brainstorm Force communications for updates on patches or mitigations.