CVE-2024-4383 is a stored cross-site scripting vulnerability in the Simple Membership WordPress plugin by wpinsider-1. The issue arises from improper input sanitization and output escaping of user-supplied attributes in the 'swpm_paypal_subscription_cancel_link' shortcode. Authenticated attackers with contributor-level permissions or higher can exploit this to inject arbitrary JavaScript that executes in the context of users visiting the injected page. The vulnerability affects all versions up to and including 4.4.5. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the compromised pages, potentially allowing theft of session tokens, defacement, or other client-side attacks. There is no indication of impact on availability. The vulnerability could lead to partial confidentiality and integrity loss of user data within the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the 'swpm_paypal_subscription_cancel_link' shortcode if possible. Monitor for updates from the plugin vendor or WordPress security channels for an official patch.