CVE-2024-9850 is a stored cross-site scripting vulnerability in the augustinfotech SVG Case Study WordPress plugin, affecting all versions up to and including 1.0. The flaw allows authenticated users with Author-level privileges or higher to inject arbitrary web scripts via SVG file uploads. This occurs due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of SVG content. The vulnerability has a CVSS 3.1 base score of 6.4, indicating a medium severity level, with network attack vector, low attack complexity, and no user interaction required. The impact includes limited confidentiality and integrity loss but no availability impact.

An attacker with Author-level access or above can inject malicious scripts into SVG files uploaded to the plugin. These scripts execute in the context of any user viewing the SVG, potentially leading to session hijacking, defacement, or other script-based attacks. The confidentiality and integrity of user data may be partially compromised. There is no direct impact on system availability. No known exploits are reported in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict Author-level access to trusted users only and consider disabling or removing the SVG Case Study plugin if possible. Implementing additional web application firewall (WAF) rules to detect and block malicious SVG uploads may help mitigate risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.