CVE-2024-5177 is a stored cross-site scripting vulnerability in the Hash Elements WordPress plugin (versions up to 1.3.8). The issue stems from improper neutralization of input in the 'url' parameter within multiple widgets, allowing authenticated attackers with contributor or higher privileges to inject arbitrary JavaScript code. This code executes in the context of users viewing the injected pages, potentially leading to session hijacking or other script-based attacks. The vulnerability is tracked under CWE-79 and has a CVSS 3.1 score of 6.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with contributor-level access or higher can exploit this vulnerability to inject persistent malicious scripts into pages served by the vulnerable plugin. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to information disclosure or other impacts related to script execution in the victim's context. There is no indication of availability impact. The vulnerability does not appear to be exploited in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Hash Elements plugin if possible to prevent exploitation.