CVE-2024-12769: 
WordPress vulnerability analysis and mitigation

The Simple Banner WordPress plugin before version 3.0.4 contains a stored Cross-Site Scripting (XSS) vulnerability. This security issue was discovered by Dmitrii Ignatyev and was assigned CVE-2024-12769. The vulnerability affects the plugin's settings functionality and was publicly disclosed on March 3, 2025 (WPScan).

The vulnerability stems from improper sanitization and escaping of certain plugin settings. The issue specifically affects the 'Header Top Margin' setting where unsanitized input can be stored and later executed. The vulnerability has been assigned a CVSS 3.1 base score of 3.5 (Low) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N (WPScan).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, even in environments where the unfiltered_html capability is disallowed, such as in multisite setups. This could potentially lead to client-side code execution in the context of other users' browsers (WPScan).

The vulnerability has been fixed in version 3.0.4 of the Simple Banner WordPress plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).