The WP Datepicker plugin for WordPress, developed by Fahad Mahmood, contains a stored cross-site scripting vulnerability (CVE-2024-44042) due to improper input neutralization during web page generation. This flaw affects all versions up to 2.1.1. Exploitation requires an attacker with privileges to submit crafted input that is stored and later rendered in a way that executes malicious scripts in the context of other users. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting medium severity with impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an attacker with privileges to inject malicious scripts that execute in the browsers of other users, potentially leading to partial compromise of confidentiality, integrity, and availability of affected systems. The attack requires user interaction and privileges, limiting its ease of exploitation. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should limit plugin usage to trusted users with minimal privileges and consider disabling or removing the WP Datepicker plugin if possible. Monitor official channels for updates or patches from the vendor.