CVE-2024-11330: 
WordPress vulnerability analysis and mitigation

The Custom CSS, JS & PHP plugin for WordPress contains a Reflected Cross-Site Scripting vulnerability (CVE-2024-11330) affecting all versions up to and including 2.3.0. The vulnerability was discovered and reported on November 23, 2024 (NVD CVE).

The vulnerability stems from improper implementation of WordPress functions add_query_arg & remove_query_arg without appropriate URL escaping. This security flaw has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD CVE).

If successfully exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when users perform specific actions, such as clicking on malicious links. The impact primarily affects confidentiality and integrity with low severity, while availability remains unaffected (NVD CVE).

The vulnerability requires user interaction to be exploited, as indicated by the CVSS metrics. An attacker needs to trick a user into performing specific actions, such as clicking on a specially crafted link, to successfully execute the attack (NVD CVE).

Users should update their Custom CSS, JS & PHP plugin to a version newer than 2.3.0 when available. The vulnerability has been identified in the plugin's settings class, specifically in the handling of URL parameters (WordPress Plugin).