CVE-2024-0688: 
WordPress vulnerability analysis and mitigation

The WebSub (formerly known as PubSubHubbub) plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-0688) affecting all versions up to and including 3.1.4. The vulnerability was discovered and disclosed on January 24, 2024, with a fix released in version 3.2.0 (NVD, WPScan).

The vulnerability stems from insufficient input sanitization and output escaping in the plugin settings. This security flaw has been assigned a CVSS v3.1 base score of 4.8 (Medium) by NVD with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. Wordfence has assigned a slightly different score of 4.4 (Medium) with a vector string of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

When exploited, this vulnerability allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to data theft or manipulation of user interactions (NVD).

The recommended mitigation is to update the WebSub plugin to version 3.2.0 or later, which contains the security fix for this vulnerability (WPScan).