CVE-2024-1328: 
WordPress vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability has been identified in Newsletter2Go WordPress plugin versions up to 4.0.14. The vulnerability was discovered on March 11, 2024, and is tracked as CVE-2024-1328. The issue affects authenticated users with subscriber-level access or higher (Wordfence Intel).

The vulnerability exists due to insufficient input sanitization and output escaping in the plugin's functionality. The issue has been assigned a CVSS score of 6.4 (Medium), indicating a moderate severity level (Wordfence Intel).

When successfully exploited, this vulnerability allows authenticated attackers with subscriber-level access to inject malicious scripts into the application, which can then be executed in other users' browsers when they view the affected pages (Wordfence Intel).

The vulnerability requires authentication with at least subscriber-level access to exploit, making it somewhat limited in scope. However, since subscriber access is often easily obtainable on many WordPress sites, this should still be considered a significant security concern (Wordfence Intel).

Website administrators running affected versions of the Newsletter2Go plugin should update to a version newer than 4.0.14 as soon as possible to address this vulnerability (Wordfence Intel).