CVE-2024-2238: 
WordPress vulnerability analysis and mitigation

The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the Custom Mouse Cursor module in versions up to and including 2.9.12. This vulnerability was discovered and disclosed on March 13, 2024 (NVD).

The vulnerability exists due to insufficient input sanitization and output escaping in the Custom Mouse Cursor module. The issue has a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is tracked as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attacker needs to have access to the WordPress admin panel to inject malicious scripts through the Custom Mouse Cursor module (NVD).

The vulnerability has been patched in version 2.9.13 of the Premium Addons PRO plugin. Users are advised to update to this version or later to mitigate the risk (Premium Changelog).