CVE-2024-9117 is a stored cross-site scripting vulnerability in the sekler Mapplic Lite WordPress plugin affecting all versions up to 1.0. The issue is caused by improper neutralization of input during web page generation, specifically through SVG file uploads. Authenticated users with Author-level access or higher can upload SVG files containing malicious scripts that are not properly sanitized or escaped, leading to script execution in the context of users viewing those SVG files. This vulnerability can potentially allow attackers to execute arbitrary web scripts, impacting confidentiality and integrity but not availability.

Successful exploitation allows an authenticated user with Author-level privileges or higher to inject and execute arbitrary scripts in the context of other users accessing the SVG files. This can lead to partial compromise of user data confidentiality and integrity within the affected WordPress site. There is no indication of impact on system availability. The vulnerability requires authenticated access, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level user permissions to trusted users only and consider disabling SVG uploads if possible. Monitor for updates from the vendor regarding patches or official mitigations.