CVE-2024-8433 is a stored cross-site scripting vulnerability in the Easy Mega Menu plugin for WordPress by ThemeHunk. The flaw exists due to insufficient input sanitization and output escaping of the 'themehunk_megamenu_bg_image' parameter, allowing authenticated users with subscriber-level privileges or higher to inject arbitrary web scripts. These scripts execute whenever a user accesses the injected page, potentially compromising user sessions or data. Although version 1.1.0 partially addressed the issue by adding authorization checks, the core sanitization problem persists in all versions up to and including 1.1.0. No official patch or fix link is currently provided.

This vulnerability enables authenticated users with low-level privileges (subscriber and above) to perform stored cross-site scripting attacks, which can lead to the execution of arbitrary scripts in the context of other users viewing the affected pages. This may result in session hijacking, defacement, or other client-side impacts. The CVSS score of 6.4 reflects a medium severity with low attack complexity but requiring privileges and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or update link is provided, users should monitor ThemeHunk's communications for a fix. In the meantime, restrict plugin usage to trusted users only and consider disabling or removing the plugin if possible. The partial fix in version 1.1.0 added authorization protection but does not fully resolve the sanitization issue, so upgrading to 1.1.0 may reduce risk but does not eliminate it.