CVE-2024-0664: 
WordPress vulnerability analysis and mitigation

The Meks Smart Social Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting (CVE-2024-0664) in all versions up to and including 1.6.3. This vulnerability stems from insufficient input sanitization and output escaping in the Meks Smart Social Widget component (NVD).

The vulnerability allows authenticated attackers with administrator-level access to inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page. This vulnerability specifically affects multi-site installations and installations where unfiltered_html has been disabled. The CVSS v3.1 base score is 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows attackers with administrator privileges to inject malicious scripts that can execute in users' browsers when they visit affected pages. This could lead to potential data theft, session hijacking, or other client-side attacks against site visitors (NVD).

A patch has been released to address this vulnerability. Site administrators should update the Meks Smart Social Widget plugin to a version newer than 1.6.3 (WordPress Plugin).