CVE-2024-13828: 
WordPress vulnerability analysis and mitigation

The Badgearoo WordPress plugin through version 1.0.14 contains a Reflected Cross-Site Scripting (XSS) vulnerability. The vulnerability was publicly disclosed on December 7, 2024, and was assigned CVE-2024-13828. This security issue affects the plugin's admin interface and could potentially impact high-privilege users such as administrators (WPScan Vuln).

The vulnerability stems from improper input sanitization and escaping of a parameter before it is output back in the page. The issue can be exploited through the WordPress admin interface at the path 'wp-admin/edit.php' with specific query parameters. The vulnerability has been assigned a CVSS score of 7.1 (High) and is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (WPScan Vuln).

This vulnerability could allow attackers to execute arbitrary web scripts in the context of high-privilege users' browsers, potentially leading to account compromise or unauthorized actions being performed with administrative privileges (WPScan Vuln).

Currently, there is no known fix available for this vulnerability. Users of the Badgearoo WordPress plugin should consider implementing additional security measures or temporarily disabling the plugin until a patch is released (Wiz).