CVE-2024-2430: 
WordPress vulnerability analysis and mitigation

The Website Content in Page or Post WordPress plugin before version 2024.04.09 contains a stored Cross-Site Scripting (XSS) vulnerability. The plugin fails to properly validate and escape certain shortcode attributes before outputting them back in pages or posts where the shortcode is embedded. This vulnerability affects users with contributor role and above, allowing them to perform stored XSS attacks (WPScan, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 5.4 (Medium) from NIST and 6.5 (Medium) from CISA-ADP. The vulnerability specifically involves the shortcode functionality where the plugin fails to properly sanitize the [horshipsrectors_get_html_curl URL] shortcode attribute (WPScan, NVD).

When exploited, this vulnerability allows attackers with contributor-level access or higher to inject malicious JavaScript code that executes when other users view the affected page or post. This can lead to various attacks including cookie theft, session hijacking, or other malicious client-side actions (WPScan).

A proof of concept exists demonstrating the vulnerability exploitation. An attacker can create or edit a post and add a malicious shortcode containing a URL to a hosted HTML file with arbitrary JavaScript code. The XSS payload will be triggered whenever any user visits the compromised page (WPScan).

The vulnerability has been fixed in version 2024.04.09 of the Website Content in Page or Post WordPress plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).