CVE-2024-9455 is a stored cross-site scripting vulnerability in the guillaume-lostweb WP Cleanup and Basic Functions WordPress plugin, affecting all versions up to and including 2.2.1. The issue stems from improper neutralization of input during web page generation (CWE-79), specifically through SVG file uploads. Authenticated attackers with Author-level access or higher can upload crafted SVG files containing malicious scripts. These scripts execute in the context of users who view the SVG files, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 score of 6.4, reflecting moderate impact on confidentiality and integrity but no impact on availability.

Successful exploitation allows authenticated users with Author-level or higher privileges to inject and store malicious scripts via SVG uploads. These scripts execute in the browsers of users who access the SVG files, potentially enabling theft of sensitive information or unauthorized actions within the affected site context. The vulnerability does not affect availability and requires authenticated access, limiting the attack surface to users with elevated permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level and higher users from uploading SVG files or disable SVG uploads entirely. Monitor plugin updates from the vendor and apply official patches once released. Avoid granting unnecessary Author-level access to untrusted users.