CVE-2024-9853 is a stored cross-site scripting vulnerability in the ID-SK Toolkit WordPress plugin affecting all versions up to and including 1.7.2. The flaw allows authenticated users with Author-level privileges or higher to upload SVG files containing malicious scripts. Due to improper input sanitization and output escaping during web page generation, these scripts execute in the context of users viewing the SVG files, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 score of 6.4, reflecting a medium severity level. No patch or official fix has been documented in the provided data.

Successful exploitation allows an authenticated user with Author-level access or above to inject and store malicious scripts via SVG file uploads. These scripts execute in the browsers of users who access the SVG files, potentially leading to limited confidentiality and integrity impacts such as theft of user data or session tokens. There is no indication of availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level and higher user permissions to trusted individuals only and consider disabling SVG file uploads if possible. Monitor vendor channels for updates and apply patches promptly once released.