CVE-2024-4734 is a stored cross-site scripting vulnerability (CWE-79) in the carazo Import and export users and customers WordPress plugin. It affects all versions up to and including 1.26.6.1. The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of admin settings input. Authenticated users with administrator-level permissions or higher can inject arbitrary web scripts that execute when other users access the affected pages. This vulnerability impacts multi-site WordPress installations or those with unfiltered_html disabled. The CVSS 3.1 base score is 4.4, reflecting a medium impact with network attack vector, high attack complexity, and required privileges.

An authenticated attacker with administrator-level permissions can inject malicious scripts that execute in the context of users viewing the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or modification of page content. The vulnerability does not affect availability and requires high privileges and a multi-site or unfiltered_html-disabled environment, limiting its scope.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict administrator access to trusted users only and consider disabling or removing the vulnerable plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates and apply patches promptly once available.