CVE-2024-4422 is a stored cross-site scripting vulnerability in the Comparison Slider WordPress plugin, affecting all versions up to and including 1.0.5. The vulnerability is due to missing authorization checks and inadequate sanitization of the slider title parameter, enabling authenticated users with subscriber or higher privileges to inject arbitrary web scripts. These scripts execute in the context of users who view the compromised pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impact.

An authenticated attacker with subscriber or higher privileges can inject persistent malicious scripts into pages using the slider title parameter. These scripts execute in the browsers of users who visit the affected pages, potentially leading to partial confidentiality and integrity impacts such as session hijacking or data theft. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user capabilities if possible and monitor for suspicious activity related to the plugin. Avoid using the vulnerable versions of the Comparison Slider plugin in sensitive environments.