CVE-2024-4939 is a stored cross-site scripting vulnerability (CWE-79) in the Weaver Xtreme Theme Support WordPress plugin. It occurs due to improper neutralization of input during web page generation, specifically in the plugin's div shortcode. Authenticated attackers with contributor-level privileges or above can inject malicious scripts via user-supplied attributes that are not properly sanitized or escaped. These scripts execute whenever a user accesses the injected page, potentially compromising user sessions or data. The vulnerability affects all plugin versions up to 6.4. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and partial confidentiality and integrity impact. No patch or vendor advisory is currently provided.

An attacker with contributor-level access or higher can exploit this vulnerability to inject and store malicious scripts within pages generated by the plugin. These scripts execute in the context of users who view the affected pages, potentially leading to session hijacking, data theft, or other actions permitted by the victim's browser context. The impact is limited to confidentiality and integrity with no availability impact. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Weaver Xtreme Theme Support plugin if possible. Monitor official wpweaver channels for updates regarding patches or mitigations.