CVE-2024-6634 is a stored cross-site scripting vulnerability in the Master Currency WP WordPress plugin, affecting all versions up to and including 1.1.61. The issue stems from improper neutralization of input during web page generation, specifically in the currencyconverterform shortcode. Authenticated attackers with contributor or higher privileges can inject malicious scripts via user-supplied shortcode attributes, which execute in the context of users viewing the compromised pages. This vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).

Successful exploitation allows an authenticated user with contributor-level access or higher to inject and store malicious scripts that execute in other users' browsers when they access the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or manipulation of page content. There is no direct availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Master Currency WP plugin if possible. Monitor plugin updates from the vendor for a security patch addressing this vulnerability.