CVE-2024-0719: 
WordPress vulnerability analysis and mitigation

The Tabs Shortcode and Widget WordPress plugin through version 1.17 contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-0719. The vulnerability was publicly disclosed on February 20, 2024, and affects users with contributor-level permissions and above (WPScan).

The vulnerability stems from the plugin's failure to properly validate and escape certain shortcode attributes before outputting them back in a page or post where the shortcode is embedded. The vulnerability has been assigned a CVSS score of 5.9 (medium severity) and is classified under CWE-79. The issue falls under the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (WPScan).

The vulnerability allows users with contributor role permissions or higher to perform Stored Cross-Site Scripting attacks through the manipulation of shortcode attributes. This could potentially lead to the execution of malicious JavaScript code in users' browsers when viewing affected pages (WPScan).

A proof of concept exploit has been documented that involves injecting malicious JavaScript code through the shortcode's css_class and css_id attributes. The exploit can be triggered when users interact with the compromised elements through events such as onmouseover (WPScan).

As of the current reporting, there is no known fix available for this vulnerability. Users of the Tabs Shortcode and Widget plugin should consider implementing additional security measures or temporarily disabling the plugin until a patch is released (WPScan).