CVE-2024-1585: 
WordPress vulnerability analysis and mitigation

The Metform Elementor Contact Form Builder plugin for WordPress has been identified with a Stored Cross-Site Scripting vulnerability (CVE-2024-1585). The vulnerability affects all versions up to and including 3.8.3. This security issue was discovered and reported by Wordfence, with the initial disclosure made on March 13, 2024 (NVD).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcode(s). The severity of this vulnerability has been assessed with a CVSS v3.1 Base Score of 6.4 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (Wordfence).

When exploited, this vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized data access or manipulation of user interactions (NVD).

The vulnerability requires authentication with at least contributor-level permissions to exploit. The attack complexity is considered low, requiring no special conditions or circumstances for exploitation (Wordfence).

Users are advised to update their Metform Elementor Contact Form Builder plugin to version 3.8.4 or later, which contains the security fix for this vulnerability (WordPress Plugin).