CVE-2024-8965 is a stored cross-site scripting vulnerability (CWE-79) in the Absolute Reviews plugin for WordPress by Code Supply Co. The flaw exists in the handling of the 'Name' field of a custom post criteria, allowing authenticated users with Contributor or higher privileges to inject arbitrary web scripts. These scripts execute in the context of any user who views the injected page, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to and including 1.1.3. The CVSS 3.1 base score is 6.4, indicating a medium severity with network attack vector, low attack complexity, and privileges required at the contributor level.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of page content. There is no direct impact on availability. No known exploits are reported in the wild at this time.

No official patch or fix is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only and consider removing or disabling the Absolute Reviews plugin if possible. Monitor vendor communications for updates on patches or official mitigations.