CVE-2024-9656 is a stored cross-site scripting vulnerability in the azexo Mynx Page Builder WordPress plugin affecting all versions up to 0.27.8. The issue occurs because the plugin does not properly sanitize or escape SVG file uploads, allowing authenticated users with Author-level access or higher to embed arbitrary scripts. These scripts execute when other users view the SVG files, potentially leading to script execution in the context of the victim's browser session. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting network attack vector, low attack complexity, required privileges at the author level, no user interaction, and impacts on confidentiality and integrity with no availability impact.

An attacker with Author-level or higher privileges can exploit this vulnerability to inject malicious scripts via SVG uploads. These scripts execute in the browsers of users who view the affected SVG files, potentially leading to unauthorized actions or data disclosure within the context of the victim's session. The impact affects confidentiality and integrity but does not affect availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and consider disabling SVG uploads if possible. Monitor for plugin updates from azexo addressing this vulnerability.