CVE-2024-6447 is a stored cross-site scripting vulnerability in the FULL – Cliente WordPress plugin affecting all versions up to and including 3.1.12. The issue is due to improper neutralization of input during web page generation, specifically through the license plan parameter. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of administrative users when they access the WordPress admin dashboard. The root cause includes insufficient input sanitization, lack of output escaping, and missing authorization and capability checks on related functions.

Successful exploitation enables an unauthenticated attacker to execute arbitrary scripts in the browser of administrative users. This can lead to session hijacking, unauthorized actions within the admin dashboard, and potential compromise of site integrity and confidentiality. The CVSS v3.1 base score is 7.2 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, administrators should consider restricting access to the wp-admin dashboard to trusted users only and monitor for suspicious activity. Applying web application firewall (WAF) rules to detect and block malicious input targeting the license plan parameter may help mitigate exploitation risk.