CVE-2024-12800: 
WordPress vulnerability analysis and mitigation

The IP Based Login WordPress plugin before version 2.4.1 contains a stored Cross-Site Scripting (XSS) vulnerability, discovered on November 14, 2024, and assigned CVE-2024-12800. This security issue affects WordPress installations using the IP Based Login plugin versions prior to 2.4.1 (WPScan).

The vulnerability stems from improper sanitization of values during the import process. This security flaw allows high-privilege users, such as administrators, to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, which is particularly concerning in multisite setups. The vulnerability has been assigned a CVSS score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (CISA-ADP).

When exploited, this vulnerability could allow authenticated administrators to inject and store malicious scripts that would execute when other users view the affected pages. This is particularly significant in multisite WordPress installations where the unfiltered_html capability is typically restricted for security purposes (WPScan).

Users are advised to update their IP Based Login WordPress plugin to version 2.4.1 or later, which contains the fix for this vulnerability (WPScan).