CVE-2024-51886 describes a stored cross-site scripting vulnerability in the Takashi Matsuyama Posts Filter plugin (versions up to 1.3.1). The issue stems from improper input neutralization during web page generation, which allows attackers to inject malicious scripts that persist and execute in the context of other users viewing the affected pages. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity), with attack vector network, low attack complexity, requiring privileges and user interaction, and impacts confidentiality, integrity, and availability at a low level. No patch or official remediation guidance is currently available, and no exploits are known in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users viewing the affected posts, potentially leading to information disclosure, session hijacking, or other client-side impacts. The impact is limited by the need for user interaction and some level of privilege. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting privileges for users who can submit content through the Posts Filter plugin and apply any available input sanitization or filtering controls. Monitor official vendor channels for updates and patches.