CVE-2024-6391 is a stored cross-site scripting vulnerability in the bobbingwide oik WordPress plugin affecting all versions up to 4.10.3. The issue is due to improper neutralization of input during web page generation, specifically in the bw_button shortcode, where user-supplied attributes are not sufficiently sanitized or escaped. This allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript that executes in the context of other users viewing the injected pages. The vulnerability is classified under CWE-79 and has a CVSS v3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).

Successful exploitation allows an authenticated contributor or higher user to inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or manipulation of page content. There is no impact on availability. The vulnerability requires authentication with contributor-level privileges, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or limiting use of the bw_button shortcode. Monitor for plugin updates from bobbingwide that address this vulnerability and apply them promptly once available.