CVE-2024-22310: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Formzu Inc.'s Formzu WP WordPress plugin, affecting versions up to and including 1.6.7. The vulnerability was identified on January 8, 2024, and tracked as CVE-2024-22310. The issue affects authenticated users with contributor-level permissions and above (Patchstack, WPScan).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcode(s). The CVSS v3.1 base score is rated as 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD, Patchstack).

This vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to unauthorized actions, data theft, or session hijacking (WPScan).

The vulnerability has been patched in version 1.6.8 of the Formzu WP plugin. Users are advised to update to this version or later to remediate the security issue (WPScan).