CVE-2024-5902 is a stored cross-site scripting vulnerability in the User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds WordPress plugin by smub. The vulnerability arises from improper neutralization of input in the 'name' parameter, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts execute when privileged users view the feedback responses, potentially leading to session hijacking or other client-side impacts. The issue affects all versions up to and including 1.0.15. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting a network attack vector, low attack complexity, no privileges required, no user interaction, scope change, and low confidentiality and integrity impact without availability impact. No patch or official remediation guidance is currently provided.

An unauthenticated attacker can inject persistent malicious scripts into feedback form responses via the 'name' parameter. When a high-privileged user views these responses, the injected scripts execute in their browser context. This can lead to confidentiality and integrity impacts such as session hijacking or unauthorized actions performed with the user's privileges. There is no reported impact on availability. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to feedback form responses to trusted users only and consider disabling or removing the plugin if feasible. Monitor for updates from the vendor or security advisories for a patch or official mitigation steps.