CVE-2024-8364 is a stored cross-site scripting vulnerability in the WP Custom Fields Search plugin for WordPress. The issue arises from improper neutralization of user-supplied input in the wpcfs-preset shortcode, allowing authenticated users with contributor or higher privileges to inject arbitrary JavaScript code. This code executes in the context of any user viewing the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability affects all versions up to and including 1.2.35. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, and limited privileges required.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to theft of user credentials, session tokens, or other malicious actions within the context of the affected site. There is no indication of impact on availability. The vulnerability does not require user interaction beyond visiting the infected page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only. Consider disabling or removing the WP Custom Fields Search plugin if it is not essential. Monitor for plugin updates from the vendor addressing this vulnerability.