CVE-2024-8721 is a stored cross-site scripting vulnerability in the data443 Tracking Code Manager WordPress plugin (versions up to 2.3.0). The vulnerability exists because the plugin does not properly sanitize or escape input in the tracking code field, allowing authenticated users with Contributor-level privileges or higher to inject arbitrary JavaScript. These scripts execute in the context of users who visit the injected pages, potentially leading to session hijacking or other script-based attacks. CVE-2024-10309 is a duplicate of this issue. No patch or official fix has been documented in the provided data.

Successful exploitation allows authenticated users with Contributor-level access or above to inject persistent malicious scripts into pages. This can lead to unauthorized actions performed in the context of other users viewing the affected pages, including theft of session tokens or other sensitive information. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, and privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider removing or disabling the Tracking Code Manager plugin if possible. Monitor for plugin updates from data443 that address this vulnerability.