The Common Tools for Site WordPress plugin (versions up to 1.0.2) suffers from a stored cross-site scripting vulnerability due to improper neutralization of input during web page generation. Specifically, SVG file uploads are not properly sanitized or escaped, enabling authenticated users with Author-level privileges or above to embed arbitrary JavaScript code. This code executes in the context of users viewing the SVG file, potentially leading to information disclosure or session hijacking. The vulnerability is tracked as CVE-2024-9115 with a CVSS 3.1 base score of 6.4 (medium severity). No patch or remediation details have been published by the vendor as of the current data.

An attacker with Author-level or higher access can inject malicious scripts via SVG file uploads, which execute when other users view the SVG. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of page content. There is no indication of availability impact. The vulnerability requires authenticated access, limiting the attack surface to users with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level and higher user permissions to trusted individuals only and consider disabling SVG uploads if possible. Monitor for updates from the plugin vendor regarding patches or official mitigations.