CVE-2024-1846: 
WordPress vulnerability analysis and mitigation

CVE-2024-1846 affects the Responsive Tabs WordPress plugin versions before 4.0.7. The vulnerability was discovered and publicly published on March 25, 2024, by security researcher Dmitrii Ignatyev (WPScan).

The vulnerability is a Stored Cross-Site Scripting (XSS) issue that exists due to insufficient input validation and output escaping of shortcode attributes in the plugin. Specifically, when these attributes are output back in a page or post where the shortcode is embedded, they are not properly sanitized (WPScan).

This vulnerability allows authenticated users with contributor-level access and above to inject arbitrary web scripts into pages. These malicious scripts will execute whenever any user accesses the compromised page (WPScan).

A proof of concept exists demonstrating the exploitation through the 'tabs_color' parameter. The attack can be executed by intercepting a request when adding a new tab and injecting malicious JavaScript code as the value for the tabs_color parameter (WPScan).

The vulnerability has been fixed in version 4.0.7 of the Responsive Tabs WordPress plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).