CVE-2024-9372 is a stored cross-site scripting vulnerability in the WP Blocks Hub WordPress plugin affecting all versions up to 1.0.2. The issue occurs because the plugin does not properly sanitize or escape SVG file uploads, allowing authenticated users with Author-level or higher privileges to embed arbitrary web scripts. These scripts execute when any user views the affected SVG files, potentially leading to client-side code execution. The vulnerability has a CVSS 3.1 score of 6.4, reflecting a medium impact on confidentiality and integrity but no impact on availability. No patch or remediation guidance is provided in the available data, and the plugin is not a cloud service.

An attacker with Author-level access or higher can exploit this vulnerability to inject malicious scripts into SVG files uploaded via the plugin. These scripts execute in the context of users who view the SVG files, potentially leading to unauthorized actions such as session hijacking or data theft limited to the scope of the affected site. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and consider disabling SVG uploads if possible. Monitor for updates from the WP Blocks Hub vendor regarding patches or official mitigations.