CVE-2024-2031: 
WordPress vulnerability analysis and mitigation

The Video Conferencing with Zoom plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-2031) in versions up to and including 4.4.4. The vulnerability exists in the plugin's 'zoom_recordings_by_meeting' shortcode due to insufficient input sanitization and output escaping on user supplied attributes (NVD).

The vulnerability stems from inadequate input sanitization and output escaping mechanisms in the plugin's 'zoom_recordings_by_meeting' shortcode functionality. The issue allows authenticated users with contributor-level permissions or higher to inject arbitrary web scripts into pages. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (Wordfence).

When successfully exploited, this vulnerability allows authenticated attackers with contributor-level or higher permissions to inject malicious web scripts into pages. These injected scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized data access or manipulation of user sessions (NVD).

The vulnerability requires an authenticated user with at least contributor-level permissions to exploit. The attack complexity is considered low, requiring no special conditions or user interaction for successful exploitation (Wordfence).

A patch has been released to address this vulnerability, as evidenced by the code changes in the WordPress plugin repository (WordPress Plugin). Users are advised to update their Video Conferencing with Zoom plugin to the latest version.