CVE-2024-9173 is a stored cross-site scripting vulnerability in the GF Custom Style plugin for WordPress, affecting all versions up to and including 2.0. The vulnerability allows authenticated users with Author-level privileges or higher to upload SVG files containing malicious scripts. Due to inadequate sanitization and escaping of SVG file content, these scripts execute in the context of users viewing the SVG files, potentially leading to script injection attacks. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows an authenticated attacker with Author-level access to inject arbitrary web scripts that execute in the browsers of users who access the malicious SVG files. This can lead to information disclosure and integrity impacts within the affected WordPress site context. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level user capabilities to upload SVG files or disable SVG uploads if possible. Monitor for plugin updates from the vendor and apply official patches once released.