CVE-2024-4546 is a stored cross-site scripting vulnerability in the Custom Post Type Attachment plugin for WordPress, affecting all versions up to 3.4.5. The issue arises from improper neutralization of user-supplied input in the 'pdf_attachment' shortcode, allowing authenticated users with contributor-level access or higher to inject arbitrary web scripts. These scripts execute in the context of any user who accesses the compromised page, potentially leading to information disclosure or session hijacking. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).

An attacker with contributor-level or higher privileges can exploit this vulnerability to inject and store malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user credentials or unauthorized actions performed on behalf of users. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Custom Post Type Attachment plugin if feasible. Monitor for plugin updates from the vendor that address this vulnerability.