CVE-2024-3977

CVE-2024-3977 is a stored Cross-Site Scripting (XSS) vulnerability affecting the WordPress Jitsi Shortcode plugin up to version 0.1. This flaw allows high-privilege users, such as administrators, to inject malicious scripts into website settings, even in environments where unfiltered HTML is typically restricted. The vulnerability has a CVSS score of 4.8 (Medium), indicating a network-based attack with low attack complexity, requiring user interaction, and resulting in low impact to confidentiality and integrity. While the attack requires high privileges, it can bypass some security controls. Currently, there is no evidence of active exploitation, nor are there publicly available exploit tools like Metasploit or Nuclei modules. The vulnerability has garnered minimal community discussion or media coverage.