CVE-2024-1752: 
WordPress vulnerability analysis and mitigation

The Font Farsi WordPress plugin versions 1.6.6 and below contain a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and publicly disclosed on March 18, 2024. This security issue affects the plugin's settings page and is particularly concerning in multisite WordPress installations (WPScan).

The vulnerability stems from improper sanitization and escaping of settings fields in the Font Farsi plugin. The issue is present in the plugin's settings page, specifically at the path '/wp-admin/admin.php?page=font-farsi-custom-font'. The vulnerability has been assigned a CVSS score of 3.5 (low severity) and is classified as CWE-79, falling under the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (WPScan).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, even in environments where the unfiltered_html capability is disabled, such as in multisite WordPress installations. Multiple fields in the settings page are potentially vulnerable to this attack (WPScan).

A proof of concept exists demonstrating the vulnerability exploitation. An attacker with administrative access can inject malicious JavaScript code into the first field of the plugin's settings page. The exploit can be triggered by adding payload such as ">alert(32) to the field and saving the changes (WPScan).

Currently, there is no known fix available for this vulnerability. Users of the Font Farsi plugin should consider implementing additional security measures or temporarily disabling the plugin until a patch is released (WPScan).