CVE-2024-7649 is a stored cross-site scripting vulnerability in the Opal Membership plugin for WordPress, affecting all versions up to and including 1.2.4. The issue stems from improper neutralization of input during web page generation, specifically in checkout form fields, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the context of users visiting the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and limited confidentiality and integrity impacts.

An attacker can inject and store malicious scripts in checkout form fields that execute when other users view the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user data or session tokens. There is no impact on availability. The vulnerability affects all users of the plugin who process checkout forms, potentially exposing them to client-side attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the checkout form functionality or applying web application firewall (WAF) rules to block suspicious input patterns. Monitor official wpopal communications for updates on patches or mitigations.