CVE-2024-5646 is a stored cross-site scripting vulnerability in the Futurio Extra WordPress plugin (versions up to and including 2.0.5). It occurs due to improper neutralization of input in the ‘header_size’ attribute within the Advanced Text Block widget, allowing authenticated users with Contributor or higher privileges to inject arbitrary web scripts. These scripts execute in the context of users viewing the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 score of 6.4, reflecting a medium severity level. No patch or official fix has been documented in the provided data.

Successful exploitation allows an authenticated user with Contributor-level or higher privileges to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to limited confidentiality and integrity impacts, such as theft of user credentials or unauthorized actions performed on behalf of users. Availability is not affected. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the Advanced Text Block widget. Monitor for plugin updates from the vendor that address this vulnerability.