CVE-2024-9642 is a stored cross-site scripting vulnerability (CWE-79) in the Editor Custom Color Palette WordPress plugin by rock4temps. The flaw exists due to inadequate sanitization and escaping of SVG file uploads, allowing authenticated users with Author-level privileges or higher to embed arbitrary web scripts. These scripts execute when any user accesses the malicious SVG file, potentially compromising user sessions or data. The vulnerability affects all versions up to and including 3.3.7. The CVSS 3.1 score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with Author-level access or higher can exploit this vulnerability to inject and store malicious scripts within SVG files. These scripts execute in the context of users viewing the SVG, potentially leading to session hijacking, data theft, or other client-side attacks. The impact is limited to confidentiality and integrity with no direct availability impact. Since the vulnerability requires authenticated access, the attack surface is constrained to users with sufficient privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and consider disabling SVG uploads if possible. Monitor plugin updates from rock4temps for a security patch addressing this issue.