CVE-2024-5346 is a stored cross-site scripting vulnerability in the UX-themes Flatsome WordPress theme affecting versions up to and including 3.18.7. The flaw arises from insufficient sanitization and escaping of user-supplied attributes in several shortcodes (UX Countdown, Video Button, UX Video, UX Slider, UX Sidebar, and UX Payment Icons). This allows authenticated users with contributor-level permissions or higher to inject arbitrary JavaScript code into pages, which executes in the context of users visiting those pages. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No known exploits in the wild have been reported, and no patch or remediation details are currently available.

Successful exploitation allows an authenticated user with contributor or higher privileges to inject malicious scripts that execute in other users' browsers when they access the compromised pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or defacement, but does not affect availability. The vulnerability requires authentication and low attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access carefully and consider disabling or limiting use of the affected shortcodes to reduce exposure.