CVE-2024-9125 is a stored cross-site scripting vulnerability in the king_IE WordPress plugin (versions up to and including 1.0). The flaw allows authenticated users with Author-level or higher privileges to upload SVG files containing malicious scripts. Due to inadequate input sanitization and output escaping, these scripts execute in the context of users viewing the SVG files, potentially leading to script injection attacks. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality and integrity with no availability impact.

Successful exploitation allows an authenticated user with Author-level access or higher to inject and execute arbitrary JavaScript in the context of other users accessing the SVG files. This can lead to theft of sensitive information, session hijacking, or other client-side attacks affecting confidentiality and integrity. There is no impact on system availability. No known exploits have been reported in the wild.

No official patch or vendor advisory with remediation instructions is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict Author-level user permissions where possible and monitor SVG file uploads for suspicious content. Consider disabling SVG uploads if not required.