CVE-2024-5342 is a stored cross-site scripting vulnerability in the Simple Image Popup Shortcode WordPress plugin by purvabathe. The issue exists in all versions up to and including 1.0 due to improper neutralization of input in the 'sips_popup' shortcode. Authenticated users with contributor or higher privileges can inject arbitrary JavaScript that executes in the context of users visiting the compromised pages. The CVSS 3.1 base score is 6.4 (medium severity), with an attack vector of network, low attack complexity, privileges required at the low level, no user interaction needed, and impacts confidentiality and integrity with no availability impact.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode. This can lead to unauthorized actions performed in the context of other users viewing the page, potentially compromising user data confidentiality and integrity. There is no direct impact on system availability. The vulnerability does not appear to be exploited in the wild based on current information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is indicated, users should consider restricting contributor-level access until a fix is available or apply manual input sanitization and output escaping as a temporary mitigation. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended.