CVE-2024-8917 is a stored cross-site scripting vulnerability (CWE-79) in the AnWP Football Leagues WordPress plugin affecting all versions up to 0.16.7. The flaw allows authenticated users with Author-level privileges or above to upload SVG files containing malicious scripts. These scripts execute in the context of users who access the SVG files, due to inadequate sanitization and escaping of SVG content during web page generation. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and impacts on confidentiality and integrity with no availability impact.

Successful exploitation allows an attacker with Author-level access to inject and execute arbitrary JavaScript in the context of users viewing the SVG files. This can lead to unauthorized actions or data disclosure limited to the privileges of the affected users. The impact is rated medium severity with partial confidentiality and integrity loss but no availability impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and consider disabling SVG uploads if possible. Monitor vendor channels for updates and apply any released patches promptly.