CVE-2024-9023 is a stored cross-site scripting vulnerability in the WP-WebAuthn plugin for WordPress, affecting all versions up to 1.3.3. The issue stems from improper neutralization of input in the wwa_login_form shortcode, where user-supplied attributes are not adequately sanitized or escaped. Authenticated users with contributor-level permissions or higher can exploit this to inject arbitrary web scripts that execute in the context of other users viewing the injected pages. This vulnerability can lead to limited confidentiality and integrity impacts but does not affect availability.

Exploitation allows authenticated users with contributor-level access or above to inject malicious scripts into pages via the wwa_login_form shortcode. These scripts execute in the context of other users visiting the affected pages, potentially leading to unauthorized actions or data exposure limited to the scope of the injected scripts. The CVSS score of 6.4 reflects a medium severity with low confidentiality and integrity impacts and no availability impact.

No official patch or remediation has been confirmed at this time. Users should monitor the vendor's advisory channels for updates. Until a fix is available, limit contributor-level access to trusted users only and consider disabling or removing the WP-WebAuthn plugin if feasible. Avoid using the wwa_login_form shortcode with untrusted input. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.