CVE-2024-9271 is a stored cross-site scripting vulnerability in the Re:WP WordPress plugin caused by improper neutralization of input during web page generation (CWE-79). The issue occurs when authenticated users with Author-level or higher privileges upload SVG files containing malicious scripts, which are not properly sanitized or escaped. These scripts execute in the context of users viewing the SVG files, potentially leading to script injection attacks. The vulnerability affects all versions up to 1.0.1 of the plugin. The CVSS 3.1 score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and privileges required at the Author level.

An attacker with Author-level or higher access can upload crafted SVG files containing malicious scripts that execute in the browsers of users who view these files. This can lead to unauthorized script execution, potentially compromising user sessions or performing actions on behalf of users. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires authenticated access, reducing the attack surface compared to unauthenticated vulnerabilities.

No official patch or remediation is currently indicated in the provided data. Users of the Re:WP plugin should monitor the vendor's advisories for updates or patches addressing this vulnerability. Until a fix is available, restricting Author-level user permissions or disabling SVG uploads may reduce risk. Applying strict input validation and output escaping for SVG content is recommended once a patch is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.