CVE-2024-9595

CVE-2024-9595 is a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 2.4.2 of the TablePress plugin for WordPress. This vulnerability allows authenticated attackers with Author-level access or higher to inject malicious web scripts into table cell content due to insufficient input sanitization. When a user accesses an affected page, these scripts will execute, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS score of 5.4 (Medium), indicating a low attack complexity and requiring user interaction, but with a potential impact on confidentiality and integrity. The EPSS score is low, suggesting a low probability of exploitation in the wild. Currently, there is no known active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, consistent with a large percentage of reported vulnerabilities.