CVE-2024-9024 is a stored cross-site scripting vulnerability in the braginteractive Material Design Icons WordPress plugin, affecting all versions up to and including 0.0.5. The issue arises from improper neutralization of input in the mdi-icon shortcode, where user-supplied attributes are not adequately sanitized or escaped. This allows authenticated users with contributor-level permissions or higher to inject arbitrary JavaScript that executes in the context of any user viewing the compromised page. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4, indicating a medium severity risk. No known exploits in the wild have been reported, and no vendor advisory or patch information is currently available.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the mdi-icon shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity to a limited extent. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Material Design Icons plugin if feasible. Monitor official sources for updates or patches from braginteractive.