CVE-2024-9116 is a stored Cross-Site Scripting vulnerability in the Monkee-Boy Essentials WordPress plugin affecting all versions up to 1.1. The flaw allows authenticated users with Author-level privileges or above to upload SVG files containing malicious scripts due to improper input sanitization and output escaping. When these SVG files are accessed by other users, the embedded scripts execute, potentially leading to unauthorized actions or data exposure within the context of the affected site. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting its medium impact with network attack vector, low attack complexity, and no user interaction required.

An attacker with Author-level access can exploit this vulnerability to inject and store malicious scripts within SVG files. These scripts execute in the browsers of users who view the SVG content, potentially leading to information disclosure or unauthorized actions within the affected WordPress site. The vulnerability does not impact availability and requires authenticated access, limiting its scope. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level and higher user permissions to trusted individuals only. Consider disabling SVG uploads or implementing additional input sanitization controls at the web application firewall or plugin level to mitigate risk.