CVE-2024-2309

WP Staging Pro versions up to 5.3.3 contain a stored cross-site scripting vulnerability in the admin settings caused by inadequate sanitization and escaping of user input. Attackers with administrator access or higher privileges can inject malicious scripts that execute when other users view affected pages, though this issue only impacts multi-site WordPress installations or those with the unfiltered_html capability disabled. The vulnerability has been patched in version 5.4.0 and later.

Based on public CVE data (MITRE/NVD).