CVE-2024-5536 is a stored cross-site scripting vulnerability in the GamiPress – Link WordPress plugin (versions up to 1.1.4). The issue stems from improper neutralization of input during web page generation, specifically in the gamipress_link shortcode, where user-supplied attributes are not adequately sanitized or escaped. Authenticated attackers with contributor or higher privileges can exploit this to inject arbitrary JavaScript that executes in the context of users visiting the compromised pages. This can lead to impacts such as session hijacking or unauthorized actions within the affected site.

The vulnerability allows authenticated users with contributor-level access or above to inject and execute arbitrary scripts in the context of other users visiting the affected pages. This can lead to information disclosure, session hijacking, or other actions permitted by the injected script. The CVSS score of 6.4 indicates a medium severity impact with low complexity and no user interaction required beyond authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the GamiPress – Link plugin if possible. Monitor for updates from the vendor or plugin author regarding patches or mitigations.