CVE-2024-10143: 
WordPress vulnerability analysis and mitigation

The MB Custom Post Types & Custom Taxonomies WordPress plugin before version 2.7.7 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability exists due to insufficient sanitization and escaping of certain settings, which affects high-privilege users such as administrators, even when the unfiltered_html capability is disallowed in multisite setups (WPScan, CVE Mitre).

The vulnerability stems from insufficient input validation in the plugin's settings, particularly in the Post Types panel. The issue is specifically present in fields like the Media frame filter field under Labels options, where user input is not properly sanitized. The vulnerability has been assigned a CVSS score of 3.5, indicating low severity (WPScan).

When exploited, this vulnerability allows high-privilege users to perform Stored Cross-Site Scripting attacks. This is particularly significant in multisite setups where the unfiltered_html capability is typically disallowed as a security measure (Wiz).

The vulnerability has been patched in version 2.7.7 of the MB Custom Post Types & Custom Taxonomies plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).