CVE-2024-1774: 
WordPress vulnerability analysis and mitigation

The Customily Product Personalizer plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-1774) in all versions up to and including 1.23.3. The vulnerability was discovered by Francesco Carlucci and publicly disclosed on April 9, 2024. This security issue affects the WordPress plugin that allows customers to personalize products in WooCommerce stores (Wordfence Intel).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') with a CVSS score of 7.2 (High). The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. The issue stems from insufficient input sanitization and output escaping of user cookies (Wordfence Intel).

This vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page. The impact is considered high due to the potential for unauthorized script execution and the unauthenticated nature of the attack (Wordfence Intel).

The vulnerability is exploitable by unauthenticated attackers, requiring no special privileges or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (Wordfence Intel).

Currently, there is no known patch available for this vulnerability. The recommended mitigation is to uninstall the affected software and find a replacement solution. Organizations should review the vulnerability details in depth and implement mitigations based on their risk tolerance (Wordfence Intel).

According to the vulnerability report, attempts to contact the vendor through various means to disclose this issue were unsuccessful, indicating potential challenges in the vulnerability disclosure process (Wordfence Intel).