CVE-2024-9073 is a stored cross-site scripting vulnerability (CWE-79) in the GutenGeek Free Gutenberg Blocks for WordPress plugin. The issue allows authenticated users with Author-level privileges or above to upload SVG files containing malicious scripts that are not properly sanitized or escaped. These scripts execute in the context of users who view the affected SVG files, potentially leading to script injection attacks. The vulnerability affects all versions up to and including 1.1.3. The CVSS 3.1 vector indicates network attack vector, low attack complexity, privileges required at the level of an authenticated author, no user interaction needed, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows an authenticated user with Author-level access or higher to inject and execute arbitrary web scripts in the context of other users viewing the SVG files. This can lead to unauthorized actions or data disclosure limited to the privileges of the affected users. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level user permissions where possible and monitor for suspicious SVG uploads. Avoid granting upload capabilities to untrusted users. Follow vendor channels for updates regarding patches or official mitigations.