CVE-2024-9582 is a stored cross-site scripting vulnerability in the bqworks Accordion Slider WordPress plugin affecting all versions up to 1.9.11. The flaw exists due to improper neutralization of input in the 'html' attribute of an accordion slider, allowing authenticated users with Contributor-level privileges or higher to inject arbitrary web scripts. Successful exploitation depends on an Administrator enabling access to the plugin's admin area via the 'Access' plugin setting, which is by default restricted to administrators. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with Contributor-level access or higher can inject malicious scripts that persist in the plugin's content and execute in the context of users viewing the affected pages. This can lead to partial confidentiality and integrity impacts, such as theft of session tokens or unauthorized actions performed on behalf of users. However, exploitation requires administrative configuration changes to allow access to the plugin's admin area, which is restricted by default, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should ensure that the 'Access' plugin setting remains restricted to administrators only to prevent Contributor-level users from exploiting this vulnerability. Monitoring and restricting user privileges to trusted users can reduce risk. Avoid granting Contributor-level users unnecessary access to the plugin's admin area.