CVE-2024-0951: 
WordPress vulnerability analysis and mitigation

CVE-2024-0951 affects the Advanced Social Feeds Widget & Shortcode WordPress plugin versions 1.7 and below. The vulnerability was discovered by Dmtrii Ignatyev and was publicly disclosed on February 20, 2024 (WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue that affects high-privilege users such as administrators. The security flaw exists because the plugin does not properly sanitize and escape some of its settings, particularly in multisite setups where the unfiltered_html capability is disallowed. The vulnerability has been assigned a CVSS score of 3.5 (Low) and is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation) (WPScan).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, even in environments where the unfiltered_html capability is disabled, such as in multisite configurations (WPScan).

The vulnerability can be exploited by inserting malicious JavaScript code in the 'CSS' field when creating a new widget. A proof of concept demonstrates that an attacker can trigger the XSS by inserting the payload '" onmouseover="alert(/XSS/)"' in the CSS field (WPScan).

Currently, there is no known fix available for this vulnerability (WPScan).