CVE-2024-11903: 
WordPress vulnerability analysis and mitigation

The WP eCards plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-11903) that affects all versions up to and including 1.3.904. The vulnerability was disclosed on December 4, 2024, and has been assigned a CVSS v3.1 base score of 6.4 (Medium) (NVD, Wordfence).

The vulnerability exists due to insufficient input sanitization and output escaping on user-supplied attributes in the plugin's 'ecard' shortcode. The issue has been classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) with a CVSS vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, requiring network access and no user interaction for successful exploitation (NVD).

Users should update to a patched version of the WP eCards plugin when available. The vulnerability has been fixed in versions after 1.3.904 (NVD).