CVE-2024-4085 is a stored Cross-Site Scripting vulnerability in the Tabellen von faustball.com WordPress plugin, affecting all versions up to and including 2.0.4. The vulnerability exists due to improper neutralization of input during web page generation, specifically in admin settings. Authenticated users with administrator privileges can inject arbitrary web scripts that execute when other users access the affected pages. This vulnerability only impacts multi-site WordPress installations or those with the unfiltered_html capability disabled. The CVSS 3.1 base score is 4.4 (medium severity) with attack vector network, high attack complexity, high privileges required, no user interaction, scope changed, and low impact on confidentiality and integrity.

An authenticated attacker with administrator-level permissions can inject malicious scripts into the plugin's admin settings, which are then stored and executed in the context of users visiting the affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed by users. The vulnerability does not affect availability. It only affects multi-site WordPress installations or those with unfiltered_html disabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict administrator access to trusted users only and consider disabling or removing the plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates or patches addressing this vulnerability.