CVE-2024-8288 is a stored cross-site scripting vulnerability in the Guten Post Layout – An Advanced Post Grid Collection WordPress plugin. It specifically involves improper neutralization of input in the 'align' attribute of the 'wp:guten-post-layout/post-grid' Gutenberg block. Authenticated users with Contributor or higher privileges can inject arbitrary JavaScript code that executes in the context of users viewing the injected content. This is due to inadequate input sanitization and output escaping in all plugin versions up to 1.2.4. The vulnerability has a CVSS 3.1 score of 6.4, reflecting a medium severity level. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

Successful exploitation allows authenticated users with Contributor-level access or above to inject and persist malicious scripts within WordPress pages using the vulnerable Gutenberg block. These scripts execute in the browsers of users who view the infected pages, potentially leading to session hijacking, privilege escalation, or other client-side attacks. The impact is limited to users who have at least Contributor privileges to inject the payload and to users who view the compromised content. There is no indication of direct impact on server availability or integrity beyond the XSS risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the Guten Post Layout – An Advanced Post Grid Collection plugin if feasible. Monitor for plugin updates from the vendor that address this vulnerability.