CVE-2024-1712: 
WordPress vulnerability analysis and mitigation

The Carousel Slider WordPress plugin before version 2.2.7 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and reported on March 25, 2024, and was assigned CVE-2024-1712. The issue affects the plugin's settings functionality, specifically impacting WordPress installations where the plugin is active (WPScan).

The vulnerability stems from improper sanitization and escaping of certain plugin settings. This security flaw allows high-privilege users, such as administrators, to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, which is particularly relevant in multisite setups. The vulnerability has been assigned a CVSS v3.1 score of 4.7 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N and is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

The vulnerability allows authenticated users with high privileges to inject malicious scripts into the plugin settings. These scripts can then be executed when other users view affected pages, potentially leading to unauthorized actions being performed in the context of the victim's browser session (WPScan).

The vulnerability has been fixed in version 2.2.7 of the Carousel Slider WordPress plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).