CVE-2024-3952 is a stored cross-site scripting vulnerability in the Advanced Ads – Ad Manager & AdSense WordPress plugin, present in all versions up to and including 1.52.1. The issue stems from improper neutralization of input during web page generation (CWE-79), specifically in the Advanced Ad widget where user-supplied attributes are not adequately sanitized or escaped. Authenticated attackers with contributor-level privileges or higher can exploit this to inject arbitrary JavaScript that executes in the context of users viewing the compromised pages. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting a medium severity level with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows an authenticated user with contributor or higher privileges to inject malicious scripts that execute in the browsers of users visiting the affected pages. This can lead to information disclosure or manipulation of page content, but does not impact availability. The vulnerability affects confidentiality and integrity to a limited extent due to the medium CVSS score and required privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access and above to trusted users only. Monitor plugin updates from monetizemore for a security patch addressing this vulnerability.