CVE-2024-11763: 
WordPress vulnerability analysis and mitigation

The Plezi plugin for WordPress (versions up to 1.0.6) contains a Stored Cross-Site Scripting vulnerability (CVE-2024-11763) that was disclosed on December 14, 2024. The vulnerability exists in the plugin's 'plezi' shortcode due to insufficient input sanitization and output escaping on user-supplied attributes (NVD Database).

The vulnerability has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The issue is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and affects the plugin's handling of user-supplied attributes in the 'plezi' shortcode (NVD Database).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to data theft or manipulation of user interactions (NVD Database).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack can be executed remotely, and due to the low complexity nature of the vulnerability, it can be relatively straightforward to exploit for attackers meeting the authentication prerequisite (NVD Database).

Users should update the Plezi plugin to a version newer than 1.0.6 if available. If an update is not possible, consider disabling the plugin or restricting access to users with contributor-level permissions and above (NVD Database).