The vulnerability CVE-2024-4636 in the Optimole WordPress plugin allows stored cross-site scripting via the 'allow_meme_types' function due to improper neutralization of input during web page generation (CWE-79). Authenticated attackers with contributor-level or higher privileges can inject malicious scripts that execute in the context of users viewing the injected pages. This can lead to limited confidentiality and integrity impacts but does not affect availability. The plugin version affected is up to 3.12.10. No patch or official fix information is currently available.

Successful exploitation allows authenticated users with contributor-level permissions or higher to inject and execute arbitrary scripts in the context of other users viewing the affected pages. This can lead to partial compromise of user confidentiality and integrity, such as session hijacking or unauthorized actions performed on behalf of users. There is no impact on system availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict contributor-level and higher permissions to trusted users only and consider monitoring for suspicious activity related to this plugin. Avoid exposing pages that allow user-generated content through this plugin to untrusted users.