CVE-2024-2470: 
WordPress vulnerability analysis and mitigation

The Simple Ajax Chat WordPress plugin before version 20240412 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability exists because the plugin does not properly sanitize and escape some of its settings, which could allow high privilege users such as administrators to perform Stored XSS attacks even when the unfiltered_html capability is disallowed, such as in multisite setups (WPScan).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The issue was partially fixed in version 0240216, but that fix was determined to be insufficient. The vulnerability allows manipulation of plugin settings through intercepted requests, where malicious JavaScript code can be injected into certain plugin parameters (WPScan).

When exploited, this vulnerability allows authenticated administrators to store and execute malicious JavaScript code on the site, which could affect other users viewing the affected pages. This is particularly concerning in multisite WordPress installations where the unfiltered_html capability is typically restricted (WPScan).

The vulnerability requires an authenticated user with administrative privileges to exploit. A proof of concept exists demonstrating how an attacker can inject malicious JavaScript code through the plugin's settings page by intercepting and modifying request parameters (WPScan).

The vulnerability has been fixed in version 20240412 of the Simple Ajax Chat plugin. Site administrators are strongly advised to update to this version or later to protect against this security issue (WPScan).