CVE-2024-10790: 
WordPress vulnerability analysis and mitigation

The Admin and Site Enhancements (ASE) plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-10790) that affects all versions up to and including 7.5.1. The vulnerability was discovered and disclosed on November 12, 2024 (NVD).

The vulnerability stems from insufficient input sanitization and output escaping in the SVG file upload functionality. This security flaw has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating a network-accessible vulnerability requiring low attack complexity and user interaction (NVD).

When exploited, this vulnerability allows authenticated attackers with custom-level access and above to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the affected SVG file (NVD).

The vulnerability is exploitable only when the SVG upload feature is enabled and specific roles have been granted access. An attacker must have authenticated access with at least custom-level privileges to exploit this vulnerability (NVD).

The vulnerability has been patched in version 7.5.2 of the Admin and Site Enhancements plugin. Users are advised to update to this latest version to protect against potential attacks (WordPress Plugin).