CVE-2024-24712: 
WordPress vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in the WordPress Heateor Social Login plugin versions 1.1.30 and below. The vulnerability was identified on January 31, 2024, and was assigned CVE-2024-24712. The issue was initially reported by Ngô Thiên An (ancorn_ from VNPT-VCI) on December 11, 2023 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation, leading to Cross-site Scripting (XSS). It received a CVSS score of 6.5, indicating a moderate severity level. The vulnerability requires contributor-level privileges or higher to exploit, with the attack vector being network-based with low attack complexity (Wordfence).

If exploited, this vulnerability could allow malicious actors to inject harmful scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would then be executed when visitors access the affected site (Patchstack).

The vulnerability has been patched in version 1.1.31 of the Heateor Social Login plugin. Users are advised to update to this version or later to remediate the security issue. The patch priority is considered low, and the vulnerability is unlikely to be exploited (Patchstack).