CVE-2024-6705 is a stored cross-site scripting vulnerability in the RegLevel plugin for WordPress, affecting all versions up to 1.2.1. The vulnerability is due to improper neutralization of input during web page generation, allowing authenticated administrators to inject arbitrary scripts via the plugin's admin settings. This vulnerability affects multi-site WordPress installations and installations where unfiltered_html is disabled. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An attacker with administrator-level permissions can inject malicious scripts that execute in the context of other users viewing the injected pages. This can lead to theft of session tokens, defacement, or other actions permitted by the victim's privileges. The vulnerability does not affect single-site installations or those with unfiltered_html enabled. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only, and consider disabling or removing the RegLevel plugin in multi-site environments where unfiltered_html is disabled. Monitor official channels for updates or patches from the vendor.