CVE-2024-2000: 
WordPress vulnerability analysis and mitigation

The Premium Addons PRO plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-2000) in versions up to and including 2.9.12. The vulnerability exists in the 'navigation_dots' parameter of the Multi Scroll Widget due to insufficient input sanitization and output escaping (NVD).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 Base Score of 5.4 (Medium) according to NVD, and 6.4 (Medium) according to Wordfence. The attack vector is network-based (AV:N), with low attack complexity (AC:L), requiring low privileges (PR:L). The vulnerability allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts that execute when users access the affected page (NVD).

When exploited, this vulnerability allows authenticated attackers to inject malicious web scripts into pages that will execute whenever a user accesses the compromised page. This could potentially lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the visiting user's browser (NVD).

The vulnerability requires an authenticated user with contributor-level access or higher privileges to exploit. The attack complexity is considered low, making it relatively straightforward to exploit once the necessary access level is obtained (NVD).

The vulnerability has been patched in version 2.9.13 of the Premium Addons PRO plugin. Users are advised to update to this version or later to mitigate the risk (Premium Changelog).