CVE-2024-5881 is a stored cross-site scripting vulnerability in the Webico Slider Flatsome Addons WordPress plugin (versions up to 2.0.1). It occurs due to improper neutralization of input in the wbc_image shortcode, allowing authenticated users with contributor or higher privileges to inject arbitrary scripts. These scripts execute in the context of users viewing the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability requires low attack complexity and no user interaction beyond viewing the injected page. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low privileges required, and impact on confidentiality and integrity.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially compromising user sessions or data confidentiality and integrity. There is no impact on availability. No known active exploitation has been reported.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Webico Slider Flatsome Addons plugin if feasible to prevent exploitation.