CVE-2024-9214 is a stored cross-site scripting vulnerability in the Extra Product Options Builder for WooCommerce plugin for WordPress. The issue arises from insufficient input sanitization and output escaping of the 'RednaoSerializedFields' parameter during the creation of a signature file. This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the injected pages. The vulnerability affects all versions up to and including 1.2.133. The CVSS 3.1 base score is 6.1 (medium severity), with an attack vector of network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality and integrity but not availability.

Successful exploitation can lead to the execution of arbitrary scripts in the context of users accessing the affected pages, potentially resulting in information disclosure and integrity impacts. The vulnerability does not affect availability. Since the attacker does not require authentication, the risk is elevated for sites using the vulnerable plugin versions. However, no known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or removing the vulnerable plugin or restricting access to affected functionality. Monitoring for updates from the vendor is recommended to apply any forthcoming patches promptly.