CVE-2024-6532 is a stored cross-site scripting vulnerability in the Sheet to Table Live Sync for Google Sheet WordPress plugin. The flaw arises from improper neutralization of input in the STWT_Sheet_Table shortcode, allowing authenticated users with contributor or higher privileges to inject arbitrary web scripts. These scripts execute in the context of users viewing the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to and including 1.0.1. No patch or official remediation has been documented in the provided data.

An attacker with contributor-level access or higher can exploit this vulnerability to inject malicious scripts into pages using the vulnerable shortcode. When other users access these pages, the injected scripts execute in their browsers, potentially leading to data theft, session hijacking, or other client-side attacks. The vulnerability does not allow unauthenticated attackers to exploit it, and it does not impact availability. The CVSS score of 6.4 reflects the medium severity of this issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Sheet to Table Live Sync for Google Sheet plugin if possible. Monitor for updates from the vendor or plugin author regarding a security patch.