CVE-2024-9866 is a stored Cross-Site Scripting vulnerability in the Event Tickets with Ticket Scanner WordPress plugin by sasonikolov. It arises from improper neutralization of input during web page generation, specifically via the 'data' parameters. This allows authenticated users with subscriber-level privileges or above to inject arbitrary scripts that execute in the context of other users viewing the injected pages. The plugin lacked proper authorization controls on ticket management functionality until version 2.4.1, and the XSS vulnerability was remediated in version 2.4.4.

Successful exploitation allows authenticated users with low privileges to inject persistent malicious scripts, potentially leading to session hijacking, defacement, or other client-side attacks when other users access the infected pages. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial confidentiality and integrity impact.

Upgrade the Event Tickets with Ticket Scanner plugin to version 2.4.4 or later, where the stored XSS vulnerability is fully patched and authorization controls are enforced. No other mitigation is necessary once the plugin is updated.