CVE-2024-2542: 
WordPress vulnerability analysis and mitigation

The Jotform Online Forms – Drag & Drop Form Builder, Securely Embed Contact Forms plugin for WordPress was identified with a Stored Cross-Site Scripting vulnerability (CVE-2024-2542). The vulnerability affects all versions up to and including 1.3.1, and was disclosed on April 18, 2024. The issue stems from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcodes (NVD CVE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. This scoring indicates that the vulnerability requires low attack complexity, needs low privileges to exploit, and can be accessed through the network with no user interaction required (Wordfence Intel).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized data access or manipulation (NVD CVE).

The vulnerability can be exploited by authenticated users with contributor-level permissions or higher through the plugin's shortcode functionality. The attack vector is accessible through the network, requiring low complexity to execute (Wordfence Intel).

A patch has been released to address this vulnerability. Users are advised to update their Jotform Online Forms plugin to a version newer than 1.3.1 (WordPress Plugins).