CVE-2024-9696 is a stored cross-site scripting vulnerability in the Rescue Shortcodes WordPress plugin, specifically in the 'rescue_tab' shortcode. The plugin fails to properly sanitize and escape user input attributes, allowing authenticated users with contributor or higher roles to inject arbitrary JavaScript code. This code executes in the context of any user who views the compromised page, potentially leading to session hijacking or other client-side attacks. The vulnerability affects all versions up to and including 2.8. The CVSS 3.1 score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, and limited privileges required.

An attacker with contributor-level access or higher can exploit this vulnerability to inject persistent malicious scripts into pages using the 'rescue_tab' shortcode. These scripts execute in the browsers of users who visit the infected pages, potentially leading to information disclosure or session hijacking. The impact is limited by the requirement for authenticated access at contributor level or above, and there is no indication of denial of service or server-side compromise.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Rescue Shortcodes plugin if possible to mitigate risk.