CVE-2024-1273: 
WordPress vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was identified in the Starbox WordPress plugin versions below 3.5.0. The vulnerability, tracked as CVE-2024-1273, was discovered by Dmitrii Ignatyev and publicly disclosed on February 13, 2024. The security flaw allows users with Contributor-level privileges or higher to perform Cross-Site Scripting attacks due to insufficient sanitization and escaping of certain parameters (WPScan).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue with a CVSS score of 6.8 (medium severity). The security flaw is mapped to CWE-79 and corresponds to the OWASP Top 10 category A7: Cross-Site Scripting (XSS). The vulnerability stems from improper parameter sanitization and validation in the plugin's functionality (WPScan).

When exploited, this vulnerability allows attackers with Contributor-level access or higher to inject and execute malicious JavaScript code in the context of other users' browsers who access the affected pages. This could lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the victim's browser session (WPScan).

A proof of concept exploit has been publicly documented, demonstrating the vulnerability through a simple JavaScript payload: 'http://132" onmouseover='alert(1)''. The attack requires the attacker to have at least Contributor-level access to the WordPress installation (WPScan).

The vulnerability has been fixed in Starbox version 3.5.0. Website administrators running affected versions should update to version 3.5.0 or later to mitigate this security risk (WPScan).