CVE-2024-8627 is a stored cross-site scripting vulnerability in the Ultimate TinyMCE WordPress plugin (versions up to 5.7). The issue occurs due to improper neutralization of input in the 'field' shortcode, allowing authenticated users with Contributor or higher privileges to inject arbitrary web scripts. These scripts execute in the context of any user who views the injected page, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, and required privileges at the contributor level.

An attacker with Contributor-level access or above can exploit this vulnerability to inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to information disclosure or session hijacking limited to the scope of the WordPress site. There is no indication of impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the 'field' shortcode in the Ultimate TinyMCE plugin. Monitor vendor channels for updates and apply patches promptly once available.