CVE-2024-8046 is a stored cross-site scripting vulnerability in the wpwax Logo Showcase Ultimate plugin for WordPress, affecting all versions up to 1.4.1. The flaw allows authenticated users with Author-level privileges or higher to upload SVG files containing malicious scripts. Due to improper input sanitization and output escaping, these scripts execute in the context of users viewing the SVG files, potentially leading to unauthorized actions or data disclosure. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, and privileges required at the Author level.

Successful exploitation can lead to the execution of arbitrary scripts in the context of users who view the malicious SVG files, potentially compromising confidentiality and integrity of data accessible to those users. There is no direct impact on availability. The attack requires authenticated access at the Author level or higher, limiting exposure to trusted users with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level and higher user permissions to trusted individuals only and consider disabling SVG file uploads if possible. Monitor vendor channels for updates and apply patches promptly once released.