CVE-2023-24004: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the WPdevart Image and Video Lightbox, Image PopUp WordPress plugin, affecting versions 2.1.5 and below. The vulnerability was identified on January 3, 2023, and was assigned CVE-2023-24004. This security issue requires administrator-level privileges to exploit (Patchstack).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue, categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). It received a CVSS v3.1 base score of 4.8 (MEDIUM) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, while Patchstack assessed it with a slightly higher score of 5.9 (MEDIUM) (NVD).

If exploited, this vulnerability could allow malicious actors to inject malicious scripts, including redirects and advertisements, as well as other HTML payloads into the website. These injected scripts would be executed when visitors access the affected site (Patchstack).

The vulnerability requires administrator-level access to exploit, which significantly reduces its risk profile. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability was patched in version 2.1.6 of the plugin. Users are advised to update to version 2.1.6 or later to remediate the security issue. Patchstack users have the additional option to enable auto-updates for vulnerable plugins (Patchstack).