CVE-2024-3987 is a stored cross-site scripting vulnerability (CWE-79) in the WP Mobile Menu – The Mobile-Friendly Responsive Menu WordPress plugin. The flaw exists in all versions up to and including 2.8.4.2, where image alt text is not properly sanitized or escaped before being rendered on web pages. This allows authenticated users with author-level or higher permissions to inject arbitrary JavaScript code that executes in the context of other users viewing the affected pages. The vulnerability has a CVSS 3.1 score of 5.4, reflecting a medium impact on confidentiality and integrity, with no impact on availability. The vulnerability requires user interaction (UI:R) and privileges (PR:L) but can be exploited remotely (AV:N).

An attacker with author-level access or higher can inject persistent malicious scripts via image alt text, which execute when other users access the compromised pages. This can lead to partial compromise of confidentiality and integrity, such as session hijacking or unauthorized actions performed on behalf of users. There is no direct impact on system availability. No known public exploits have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level access to trusted users only and consider disabling or limiting the use of image alt text inputs in the plugin. Monitor for plugin updates from the vendor and apply official patches promptly once released.