CVE-2024-11410: 
WordPress vulnerability analysis and mitigation

The YooBar WordPress plugin (versions up to 2.0.6) contains a Stored Cross-Site Scripting vulnerability (CVE-2024-11410). The vulnerability exists in the Yoo Bar settings functionality due to insufficient input sanitization and output escaping. This security issue was discovered and reported on December 11, 2024 (NVD, Wordfence).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue, identified as CWE-79. It has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The vulnerability stems from improper input validation and output escaping in the Yoo Bar settings functionality (NVD).

When exploited, this vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially compromising user data or performing unauthorized actions on behalf of visitors (NVD).

The vulnerability requires an authenticated user with at least Contributor-level access to exploit. The attack complexity is considered low, requiring no special conditions or user interaction for successful exploitation (NVD).

Users are advised to update their YooBar plugin to a version newer than 2.0.6 when available. Until then, site administrators should consider restricting access to the Yoo Bar settings functionality to trusted users only (WordPress Plugin).