CVE-2024-4895 is a stored cross-site scripting vulnerability in the wpDataTables WordPress plugin (versions up to 3.4.2.12). The flaw exists because the plugin does not properly sanitize or escape input during CSV import, enabling unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 4.7, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

An attacker can inject malicious scripts into pages via the CSV import feature without authentication. When other users view these pages, the scripts execute in their browsers, potentially compromising user data or session integrity. The impact is limited to confidentiality and integrity with no availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting CSV import functionality or applying manual input validation and output escaping as a temporary mitigation.