CVE-2024-9442 is a stored cross-site scripting vulnerability in the faktorvier F4 Improvements WordPress plugin (versions up to 1.9.0). It allows authenticated users with Author-level or higher privileges to upload SVG files containing malicious scripts. Due to inadequate sanitization and escaping of SVG input, these scripts execute in the context of users viewing the SVG files, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS 3.1 score of 6.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with Author-level access or higher can exploit this vulnerability to inject and store malicious scripts within SVG files. These scripts execute in the browsers of users who view the SVG files, potentially compromising confidentiality and integrity of user sessions or data. The vulnerability does not affect availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level user permissions to trusted users only and consider disabling SVG uploads if possible. Monitor for updates from faktorvier regarding a security patch or update to the F4 Improvements plugin.