CVE-2024-2310: 
WordPress vulnerability analysis and mitigation

The WP Google Review Slider WordPress plugin before version 13.6 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered on April 5, 2024, and affects high-privilege users such as administrators, particularly in multisite setups where the unfiltered_html capability is disallowed (WPScan).

The vulnerability stems from improper sanitization and escaping of certain plugin settings. Specifically, the issue is related to the template settings where background color parameters can be manipulated to inject malicious scripts. The vulnerability has been assigned a CVSS v3.1 score of 5.9 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L (NVD).

When exploited, this vulnerability allows high-privilege users to perform Stored Cross-Site Scripting attacks, even in environments where the unfiltered_html capability is disabled. This is particularly concerning in multisite WordPress installations where such restrictions are commonly implemented for security purposes (WPScan).

A proof of concept exists demonstrating the exploitation method: 1) Navigate to 'WP Google Reviews > Templates' and click on 'Add New Reviews Template' 2) Save the settings and intercept the request 3) Modify the 'wprevpro_template_misc_bgcolor1' parameter to include malicious JavaScript 4) Upon template reload and color selection, the XSS payload executes (WPScan).

The vulnerability has been patched in version 13.6 of the WP Google Review Slider plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).