CVE-2024-23501: 
WordPress vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability has been identified in Shopfiles Ltd's Ebook Store WordPress plugin, affecting versions up to 5.788. The vulnerability was discovered on January 18, 2024, and publicly disclosed on February 28, 2024. This security issue has been assigned the identifier CVE-2024-23501 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It has received a CVSS v3.1 base score of 4.8 (Medium) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, while Patchstack assigned a slightly higher CVSS score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability could allow a malicious actor to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack).

The vulnerability requires administrator privileges to exploit, and has been classified as having a low severity impact that is unlikely to be exploited (Patchstack).

The vulnerability has been fixed in version 5.8002 of the Ebook Store plugin. Users are advised to update to version 5.8002 or later to remove the vulnerability. Patchstack users have the option to enable auto-update for vulnerable plugins (Patchstack).