CVE-2024-11905: 
WordPress vulnerability analysis and mitigation

The Animated Counters plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-11905) affecting all versions up to and including 2.0. The vulnerability was disclosed on December 16, 2024, and received a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, NVD).

The vulnerability exists in the plugin's 'animatedcounter' shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. The issue is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability has been assigned a CVSS v3.1 score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, requiring no user interaction for successful exploitation (NVD).

The plugin has been closed as of December 13, 2024, due to this security issue. Users should immediately remove the Animated Counters plugin from their WordPress installations (WordPress).