CVE-2024-1041: 
WordPress vulnerability analysis and mitigation

The WP Radio – Worldwide Online Radio Stations Directory for WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.1.9. The vulnerability was discovered and disclosed on April 10, 2024, affecting the plugin's settings functionality (NVD).

The vulnerability stems from insufficient input sanitization and output escaping in the plugin's settings, combined with inadequate access control. The issue has been assigned a CVSS v3.1 base score of 5.4 (Medium) by NVD and 6.4 (Medium) by Wordfence, with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated user with at least subscriber-level privileges to exploit. The attack vector is network-accessible, with low attack complexity, requiring low privileges and user interaction (NVD).

The plugin has been closed as of March 7, 2024, due to security issues and is no longer available for download. Users should immediately remove this plugin from their WordPress installations (WordPress Plugin).