CVE-2024-4097 is a stored cross-site scripting vulnerability in the StylemixThemes Cost Calculator Builder PRO WordPress plugin, affecting all versions up to and including 3.1.67. The issue is due to improper neutralization of input during web page generation, specifically through the SVG upload feature, which lacks sufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the compromised pages. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity, with network attack vector, low attack complexity, no privileges required, no user interaction needed, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows unauthenticated attackers to perform stored cross-site scripting attacks, potentially leading to arbitrary script execution in users' browsers when they visit pages containing the injected SVG content. This can result in theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality and integrity of user data. There are no reports of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the SVG upload feature or restricting file uploads to trusted users only. Monitoring for suspicious SVG uploads and applying web application firewall (WAF) rules targeting XSS payloads may provide temporary mitigation.