CVE-2024-13634: 
WordPress vulnerability analysis and mitigation

The Post Sync WordPress plugin through version 1.1 contains a Reflected Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-13634. The vulnerability was discovered by Hassan Khan Yusufzai (Splint3r7) and was publicly disclosed on February 4, 2025. This security issue affects high-privilege users such as administrators (WPScan).

The vulnerability stems from improper input validation where the plugin fails to sanitize and escape a parameter before outputting it back in the page. The vulnerability has been assigned a CVSS score of 7.1 (high) and is classified under CWE-79 (Cross-Site Scripting). A proof of concept exploit involves accessing the URL: https://example.com/wp-admin/admin.php?page=add-site&id=1">alert(1) (WPScan).

The vulnerability can be exploited to perform cross-site scripting attacks against high-privilege users such as administrators, potentially leading to unauthorized actions being performed in the context of the administrator's session (WPScan).

The vulnerability is exploitable through a reflected XSS attack vector, requiring the target to be a high-privilege user such as an administrator. A proof of concept exploit has been publicly documented (WPScan).

Currently, there is no known fix available for this vulnerability in the Post Sync WordPress plugin (WPScan).