CVE-2024-0673: 
WordPress vulnerability analysis and mitigation

The Pz-LinkCard WordPress plugin through version 2.5.1 contains a Cross-Site Scripting (XSS) vulnerability. The plugin fails to properly sanitize and escape some of its settings, which could enable high-privilege users such as administrators to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (WPScan).

The vulnerability exists in the plugin's settings functionality, specifically in the 'Class ID to be Added (for PC)' setting accessible at /wp-admin/options-general.php?page=pz-linkcard-settings under the Advanced section. The CVSS 3.1 score is 6.1 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (CISA-ADP).

When exploited, this vulnerability allows authenticated administrators to store and execute malicious JavaScript code on the website, even when the WordPress unfiltered_html capability is disabled. This could potentially lead to client-side attacks against other users viewing pages containing the affected blogcard shortcodes (WPScan).

The vulnerability can be exploited by inserting malicious JavaScript code into the plugin's settings. For example, placing a payload like '" onmouseover=alert(/XSS/)//' in the 'Class ID to be Added (for PC)' setting, and then accessing a page containing a blogcard shortcode (such as [blogcard url="aaa"]) will trigger the XSS when hovering over the generated card (WPScan).

The vulnerability has been patched in version 2.5.3 of the Pz-LinkCard plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).