CVE-2024-2309: 
WordPress vulnerability analysis and mitigation

The WP STAGING WordPress Backup Plugin before version 3.4.0 and wp-staging-pro WordPress plugin before version 5.4.0 contain a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and disclosed on March 27, 2024, and affects the plugin's settings functionality where certain fields are not properly sanitized and escaped (WPScan).

The vulnerability exists due to improper sanitization and escaping of some settings in the plugin. This security issue specifically affects the backup name field in the 'WP Staging > Backup & Migration' section. The vulnerability can be exploited even when the unfiltered_html capability is disallowed, such as in multisite setups. The CVSS score assigned by CISA-ADP is 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks. The impact is considered medium severity due to the requirement of high privileges for exploitation and the potential for compromising user sessions or performing unauthorized actions on behalf of other users (WPScan).

The vulnerability can be exploited by an authenticated user with administrative privileges by editing an existing backup's 'Backup Name' field and injecting malicious JavaScript code. A proof of concept demonstrates that setting the backup name to '123123" onmouseover='alert(1)'' triggers the XSS when reopening the edit screen (WPScan).

Users should upgrade to WP STAGING version 3.4.0 or later for the free version, or version 5.4.0 or later for the pro version to address this vulnerability (WPScan).