CVE-2024-6363 describes a stored cross-site scripting vulnerability in the urkekg Stock Ticker WordPress plugin. The flaw exists in the handling of the stock_ticker shortcode, where user input is not properly sanitized or escaped before being rendered in web pages. This allows authenticated users with contributor or higher privileges to inject malicious scripts that persist and execute in the context of other users viewing the page. The vulnerability affects all versions up to and including 3.24.4. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, and privileges required at the contributor level.

Successful exploitation permits an authenticated contributor or higher to inject persistent malicious scripts into pages using the stock_ticker shortcode. This can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation, but does not affect availability. The vulnerability requires authenticated access, reducing the attack surface compared to unauthenticated XSS. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Stock Ticker plugin if possible. Monitor for vendor updates regarding patches or official mitigations.