CVE-2024-4869 is a stored cross-site scripting vulnerability in the WP Cookie Consent plugin (versions up to 3.2.0) caused by improper neutralization of input from the ‘Client-IP’ HTTP header. This flaw allows unauthenticated attackers to inject arbitrary web scripts into pages generated by the plugin, which execute in the context of users visiting those pages. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 7.2, reflecting high severity due to its network accessibility and impact on confidentiality and integrity. The plugin is not a cloud service, and no official patch or vendor advisory with remediation instructions is currently available.

Successful exploitation allows an unauthenticated attacker to perform stored cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in users' browsers. This can result in theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality and integrity. The vulnerability does not affect availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying temporary mitigations such as disabling the plugin or restricting access to affected pages if feasible. Monitor the vendor’s official channels for updates and apply patches promptly once available.