CVE-2024-2423: 
WordPress vulnerability analysis and mitigation

The UsersWP WordPress plugin (versions up to and including 1.2.6) contains a Stored Cross-Site Scripting vulnerability (CVE-2024-2423) that was discovered and disclosed on April 9, 2024. The vulnerability affects the plugin's shortcode functionality and impacts WordPress installations using the UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin (NVD).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcode implementation. The issue has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, indicating a network-accessible vulnerability requiring low attack complexity and low privileges (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized actions and data theft (NVD).

The vulnerability requires an authenticated user with at least contributor-level permissions to exploit. The attack vector is through the plugin's shortcode functionality, making it relatively straightforward to exploit for users with appropriate access levels (NVD).

Users should update their UsersWP plugin to version 1.2.7 or later, which contains fixes for this vulnerability. The update addresses the input sanitization and output escaping issues in the shortcode implementation (NVD).