CVE-2024-9454 is a stored cross-site scripting vulnerability in the PriPre WordPress plugin caused by improper neutralization of input during web page generation. Specifically, SVG file uploads are not adequately sanitized or escaped, allowing authenticated users with Author-level access or higher to inject arbitrary web scripts. These scripts execute when any user accesses the affected SVG files, potentially compromising user sessions or data. The vulnerability affects all versions up to and including 0.4.11. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, privileges required at the Author level, no user interaction, and impacts on confidentiality and integrity with no availability impact.

An attacker with Author-level access or higher can exploit this vulnerability to inject and store malicious scripts via SVG file uploads. These scripts execute in the context of users who view the SVG files, potentially leading to session hijacking, data theft, or other malicious actions affecting confidentiality and integrity. There is no impact on availability. No known exploits have been reported in the wild.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict Author-level user permissions to trusted individuals only and consider disabling SVG file uploads if possible to reduce risk.