CVE-2024-9051 is a stored cross-site scripting vulnerability in the WP Ultimate Post Grid plugin for WordPress, affecting all versions up to and including 3.9.3. The issue arises from improper neutralization of user-supplied input in the wpupg-grid-with-filters shortcode, allowing authenticated contributors or higher to inject arbitrary web scripts. These scripts execute in the context of users visiting the compromised pages, potentially leading to session hijacking or other script-based attacks. The vulnerability requires authenticated access with contributor privileges and does not require user interaction beyond viewing the injected page.

Successful exploitation allows an authenticated user with contributor-level access or higher to inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who visit the affected pages, potentially leading to information disclosure or session hijacking. The vulnerability does not affect availability and requires authenticated access, limiting its impact to confidentiality and integrity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the WP Ultimate Post Grid plugin if possible. Monitor for plugin updates from the vendor that address this vulnerability.