CVE-2024-11645: 
WordPress vulnerability analysis and mitigation

The float block WordPress plugin through version 1.7 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered on December 6, 2024, and was assigned CVE-2024-11645. The issue affects the plugin's settings functionality, specifically impacting WordPress installations where the plugin is active (WPScan).

The vulnerability stems from improper sanitization and escaping of certain plugin settings. This security flaw exists even when the unfiltered_html capability is disallowed, which is particularly relevant in multisite setups. The vulnerability has been assigned a CVSS 3.1 score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks. The impact is particularly concerning in multisite WordPress installations where even administrators are typically restricted from using unfiltered HTML (WPScan).

The vulnerability can be exploited by adding the Widget "Плавающий блок" to the site and manipulating the input value for "Ширина блока, px" with malicious JavaScript code. This has been demonstrated with a proof of concept using the payload "><alert(1) (WPScan).

Currently, there is no known fix available for this vulnerability. Users should consider either removing the plugin or implementing additional security controls to restrict access to the plugin's settings (WPScan).