CVE-2024-25597: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability has been identified in Etoile Web Design Ultimate Reviews WordPress plugin versions through 3.2.8, tracked as CVE-2024-25597. The vulnerability allows for Stored XSS attacks and was discovered by Kang SeoHee on December 25, 2023, with public disclosure on February 12, 2024 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79). It has received a CVSS v3.1 base score of 6.1 (Medium) from NVD with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while Patchstack rates it slightly higher at 7.1 (High) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (NVD).

This vulnerability could allow malicious actors to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website which will be executed when guests visit the site. The attack requires user interaction but can potentially lead to data exposure and website compromise (Patchstack).

The vulnerability is particularly concerning as it can be exploited by unauthenticated attackers, requiring no special privileges. The attack complexity is rated as low, indicating relatively straightforward exploitation (NVD).

Users are advised to update to Ultimate Reviews version 3.2.9 or later which contains the fix for this vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users can update to a fixed version (Patchstack).