CVE-2024-2444: 
WordPress vulnerability analysis and mitigation

CVE-2024-2444 affects the Inline Related Posts WordPress plugin versions before 3.5.0. The vulnerability was discovered by Dmitrii Ignatyev and was publicly disclosed on March 16, 2024. This security issue exists in the plugin's settings functionality, where insufficient sanitization and escaping of certain settings could enable cross-site scripting (XSS) attacks (WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS v3.1 base score of 4.8 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The technical issue stems from improper sanitization and escaping of plugin settings, specifically in the CSS margin-top settings parameter. This vulnerability can be exploited even when the unfiltered_html capability is disabled (WPScan).

The vulnerability allows high-privilege users such as administrators to perform Cross-Site Scripting attacks. When successfully exploited, it could lead to the execution of malicious JavaScript code in the context of other users' browsers who view affected pages, potentially compromising their sessions or leading to other client-side attacks (WPScan).

A proof of concept exists demonstrating that the vulnerability can be exploited by inserting a malicious payload in the CSS margin-top settings. The payload is triggered when users move their mouse over the 'See also' link in any post or page. The attack requires high privileges (admin access) to execute (WPScan).

The vulnerability has been fixed in version 3.5.0 of the Inline Related Posts plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).