CVE-2024-1684: 
WordPress vulnerability analysis and mitigation

A stored cross-site scripting vulnerability was discovered in Otter Blocks PRO version 2.6.3 and earlier. The vulnerability affects authenticated users with contributor or higher privileges due to insufficient input sanitization and output escaping in the File Field CSS component (Wordfence).

The vulnerability is tracked as CVE-2024-1684 and has been assigned a CVSS score of 6.4 (Medium). The issue stems from inadequate input sanitization and output escaping mechanisms in the File Field CSS component of the plugin. This security flaw could potentially allow authenticated users with contributor-level access or higher to inject malicious scripts (Wordfence).

If exploited, this vulnerability could allow authenticated attackers to store and execute malicious scripts, potentially affecting other users who access the affected pages. Since it requires authentication at the contributor level or higher, the impact is somewhat limited but still significant for sites with multiple users with elevated privileges (Wordfence).

The vulnerability requires authentication with contributor-level access or higher to exploit. This requirement significantly reduces the risk of exploitation from external attackers but makes it a potential vector for insider threats or compromised accounts (Wordfence).

The vulnerability has been patched in newer versions of Otter Blocks PRO. Site administrators are strongly advised to update to the latest version of the plugin to protect against this security issue. The fix was implemented as part of the security enhancements in version 2.6.4 and later releases (ThemeIsle Changelog).