CVE-2024-4700 is a stored cross-site scripting vulnerability (CWE-79) in the WP Table Builder WordPress plugin affecting all versions up to and including 1.4.14. The issue arises from improper neutralization of input in the button element, allowing authenticated users with sufficient privileges (administrators by default, contributors if configured) to inject arbitrary web scripts. These scripts execute in the context of users viewing the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and partial impact on confidentiality and integrity.

An authenticated attacker with administrator or contributor privileges can inject malicious scripts that execute in the browsers of users who view the compromised pages. This can lead to partial confidentiality and integrity impacts, such as theft of sensitive information or unauthorized actions performed on behalf of the user. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin usage to trusted administrators only and review user roles to limit contributor access to WP Table Builder features. Monitor official vendor channels for updates and apply patches promptly once released.