CVE-2024-5162 is a stored cross-site scripting vulnerability (CWE-79) in the ibabar PrettyPhoto – Simple Lightbox Plugin for WordPress. The flaw exists in all versions up to and including 1.2.3, where the 'url' parameter is not properly sanitized or escaped. This allows authenticated attackers with Contributor or higher privileges to inject arbitrary web scripts that execute in the context of users viewing the compromised pages. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. The vulnerability impacts confidentiality and integrity but not availability.

An attacker with Contributor-level or higher access can store malicious scripts via the 'url' parameter, leading to script execution in other users' browsers when they access the injected pages. This can result in unauthorized actions or data exposure within the context of the affected WordPress site. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or patch links are provided in the available data. Users should monitor the vendor's advisory for updates and apply any official patches once released. Until then, restrict Contributor-level access to trusted users and consider disabling or replacing the PrettyPhoto plugin to mitigate risk.