CVE-2024-9184 is a stored cross-site scripting vulnerability in the SendPulse Free Web Push WordPress plugin (versions up to and including 1.3.6). The vulnerability is caused by improper neutralization of input during web page generation, specifically due to incorrect use of the wp_kses_allowed_html function. This flaw enables unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the compromised pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with scope change.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary JavaScript in the context of users visiting affected pages, potentially leading to data theft, session hijacking, or other malicious actions impacting confidentiality and integrity. Availability is not affected. The vulnerability affects all versions up to 1.3.6 of the SendPulse Free Web Push plugin.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates and apply any forthcoming patches promptly. Until a fix is released, consider disabling or removing the vulnerable plugin to prevent exploitation.