CVE-2024-9590 is a stored cross-site scripting vulnerability in the Category and Taxonomy Meta Fields WordPress plugin (versions up to 1.0.0). The flaw exists in the 'wpaft_add_meta_textinput' function, where user-supplied input in the image meta field is not properly sanitized or escaped before being output. This allows authenticated users with editor or higher privileges to inject arbitrary web scripts into pages. The vulnerability affects multi-site WordPress setups or installations with unfiltered_html disabled, enabling persistent script execution when the injected pages are accessed.

An attacker with editor-level or higher permissions can exploit this vulnerability to inject malicious scripts that execute in the context of other users viewing the affected pages. This can lead to theft of user credentials, session hijacking, or other actions permitted by the victim's browser context. The impact is limited to multi-site installations or those with unfiltered_html disabled, reducing the overall attack surface. There is no indication of known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict editor-level permissions carefully and consider disabling or removing the vulnerable plugin in multi-site environments or where unfiltered_html is disabled. Avoid granting elevated privileges to untrusted users. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.