CVE-2024-13101: 
WordPress vulnerability analysis and mitigation

The WP MediaTagger WordPress plugin through version 4.1.1 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability exists because the plugin does not properly validate and escape certain shortcode attributes before outputting them back in pages or posts where the shortcode is embedded (WPScan, NVD).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS score of 5.9 (medium). The security flaw exists in the shortcode functionality of the plugin, where certain attributes are not properly sanitized before being rendered on the page. Users with contributor-level permissions or higher can exploit this vulnerability by injecting malicious JavaScript code through shortcode attributes (WPScan).

This vulnerability allows authenticated users with contributor-level access or higher to perform Stored Cross-Site Scripting attacks. When successfully exploited, the attacker can inject malicious JavaScript code that executes in the context of other users' browsers when they view the affected page or post (WPScan).

Currently, there is no known fix available for this vulnerability. Users of the WP MediaTagger plugin should consider either removing the plugin or implementing additional security controls to restrict access to users who can create and edit posts (WPScan).