CVE-2024-7134 is a stored cross-site scripting vulnerability in the LiquidPoll – Polls, Surveys, NPS and Feedback Reviews WordPress plugin affecting all versions up to 3.3.78. The vulnerability stems from improper neutralization of input in the 'form_data' parameter, allowing unauthenticated attackers to inject arbitrary web scripts that execute when users view the injected pages. This can lead to client-side code execution impacting confidentiality and integrity of user interactions. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and scope change with partial confidentiality and integrity impact. No patch or vendor advisory is currently referenced, and no known exploits have been reported.

Successful exploitation allows unauthenticated attackers to perform stored cross-site scripting attacks, potentially leading to theft of user credentials, session hijacking, or other malicious client-side actions when users access the compromised pages. The impact affects confidentiality and integrity but not availability. The vulnerability is exploitable remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or removing the LiquidPoll plugin if feasible. Implementing web application firewall (WAF) rules to detect and block malicious input targeting the 'form_data' parameter may provide temporary mitigation. Monitor official LiquidPoll and WordPress security channels for updates.