CVE-2024-7388 is a stored cross-site scripting vulnerability in the WP Bannerize Pro WordPress plugin (versions up to 1.9.0). It occurs due to improper neutralization of input during web page generation, specifically in the handling of banner alt attribute data. Authenticated attackers with editor or higher privileges can inject arbitrary scripts that execute in the context of users viewing the affected pages. The vulnerability affects multi-site installations or single sites where the unfiltered_html capability is disabled, limiting the attack surface. The CVSS 3.1 base score is 4.0, reflecting a medium severity with network attack vector, high attack complexity, and required privileges.

Successful exploitation allows an attacker with editor-level or higher permissions to inject persistent malicious scripts into pages, potentially leading to limited confidentiality and integrity impacts within affected WordPress sites. The vulnerability does not affect availability and requires user interaction. It is limited to multi-site or restricted unfiltered_html environments, reducing the scope of exploitation.

No official patch or fix is currently available for this vulnerability. Administrators should monitor the vendor's advisory for updates. Until a fix is released, restricting editor-level permissions and carefully controlling user input in banner alt fields can reduce risk. Since this vulnerability affects only multi-site installations or those with unfiltered_html disabled, consider these configurations when assessing exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.