CVE-2024-3944 is a stored cross-site scripting vulnerability in the WP To Do plugin for WordPress, affecting all versions up to 1.3.0. The vulnerability is due to improper neutralization of input during web page generation, specifically in comment handling. Authenticated attackers with administrator privileges can inject malicious scripts that execute in the context of users visiting the affected pages. This issue is limited to multi-site installations or those with unfiltered_html disabled, reducing the attack surface. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and impacts confidentiality and integrity with no availability impact.

An attacker with administrator-level permissions can inject and execute arbitrary JavaScript in affected WordPress multi-site environments or where unfiltered_html is disabled. This can lead to partial confidentiality and integrity loss, such as stealing session tokens or modifying content. There is no direct impact on availability. The vulnerability does not affect single-site installations or those with unfiltered_html enabled. No known exploits are reported in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's announcements for updates. Until a fix is released, restrict administrator access to trusted users only and consider disabling or removing the WP To Do plugin in multi-site environments or where unfiltered_html is disabled. Review and sanitize comments manually if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.