CVE-2024-7304 is a stored Cross-Site Scripting vulnerability in the Ninja Tables – Easy Data Table Builder WordPress plugin, affecting all versions up to 5.0.12. The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of SVG file uploads. Authenticated attackers with Author-level privileges or higher can upload crafted SVG files containing malicious scripts. These scripts execute in the context of users who view the SVG files, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity), with network attack vector, low attack complexity, privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with Author-level access or higher can exploit this vulnerability to inject and store malicious scripts via SVG file uploads. These scripts execute when other users access the SVG files, potentially allowing the attacker to steal sensitive information or perform actions on behalf of the victim. The impact affects confidentiality and integrity but does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict SVG file uploads to trusted users only and consider disabling SVG uploads if not required. Monitor plugin updates from the vendor and apply official patches promptly once released.