The vulnerability CVE-2024-7317 affects the 'Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager' WordPress plugin through stored cross-site scripting via SVG file uploads. Authenticated attackers with Contributor-level privileges can upload crafted SVG files containing malicious scripts that execute in the context of users viewing those files. This occurs due to improper input sanitization and output escaping in the plugin versions up to and including 3.0.3. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at the contributor level, no user interaction needed, and impacts confidentiality and integrity with no availability impact. No patch or official fix has been documented yet.

Successful exploitation allows an attacker with Contributor-level access to inject and execute arbitrary web scripts in the context of users accessing the malicious SVG files. This can lead to unauthorized actions or data disclosure limited to the confidentiality and integrity of affected users. There is no indication of availability impact. The vulnerability affects all versions up to 3.0.3 of the plugin. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level user permissions to trusted users only and consider disabling SVG uploads if possible. Monitor official plugin updates and apply any released patches promptly.