CVE-2024-3946 is a stored cross-site scripting vulnerability in the WP To Do plugin for WordPress (versions ≤ 1.3.0). It arises from improper neutralization of input during web page generation, specifically in admin settings. Authenticated attackers with administrator privileges can inject malicious scripts that execute in the context of users visiting affected pages. This vulnerability impacts multi-site WordPress setups or installations with unfiltered_html disabled. No patch or official fix information is provided in the available data.

Successful exploitation allows an authenticated administrator to inject arbitrary web scripts that execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of users. The vulnerability does not affect availability and requires high privileges and no user interaction beyond visiting the injected page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or limiting use of the WP To Do plugin in multi-site environments or where unfiltered_html is disabled. Monitor for updates from the vendor delower186 regarding patches or official mitigations.