The vulnerability CVE-2024-7588 in the pickplugins Post Grid WordPress plugin allows stored cross-site scripting via the Accordion block due to improper neutralization of input during web page generation. Authenticated attackers with contributor-level privileges or higher can inject arbitrary JavaScript into pages, which executes when viewed by other users. This is caused by insufficient sanitization and escaping of user-supplied attributes in the plugin versions up to 2.2.87. The CVSS 3.1 base score is 6.4, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact. No patch or remediation details are currently available from the vendor or advisory sources.

An attacker with contributor-level or higher access can inject malicious scripts into pages using the vulnerable Accordion block. These scripts execute in the context of users viewing the affected pages, potentially leading to unauthorized actions or data disclosure limited to confidentiality and integrity impacts. There is no reported impact on availability. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit contributor-level access to trusted users only and consider disabling or avoiding use of the vulnerable Accordion block. Monitor vendor channels for updates and apply patches promptly once available.