CVE-2024-9601 is a stored cross-site scripting vulnerability in the Qubely – Advanced Gutenberg Blocks WordPress plugin affecting all versions up to 1.8.12. The issue stems from improper neutralization of input during web page generation, specifically in the 'align' and 'UniqueID' parameters. Authenticated attackers with Contributor-level privileges or higher can inject arbitrary web scripts that execute in the context of users viewing the compromised pages. This vulnerability is tracked under CWE-79 and has a CVSS 3.1 score of 6.5 (medium severity). No patch or remediation details are currently provided by the vendor.

Successful exploitation allows an authenticated user with Contributor or higher privileges to inject stored malicious scripts into pages. These scripts execute in the browsers of users who view the infected pages, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability does not affect confidentiality or availability directly but impacts integrity of the web content and user trust. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access and above to trusted users only. Monitor plugin updates from the vendor and apply any official patches promptly once released. Avoid using the vulnerable parameters ('align' and 'UniqueID') in untrusted contexts if possible.