CVE-2024-2580: 
WordPress vulnerability analysis and mitigation

CVE-2024-2580 is a Cross-site Scripting (XSS) vulnerability affecting FunnelKit Automation By Autonami WordPress plugin versions up to and including 2.8.2. The vulnerability was discovered and disclosed on March 18, 2024, and has been assigned a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) that allows for Stored Cross-Site Scripting. The issue stems from insufficient input sanitization and output escaping in the plugin (WPScan).

This vulnerability makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (WPScan).

The vulnerability requires authentication with at least contributor-level access to exploit. The CVSS vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L indicates that the vulnerability can be exploited over the network with low attack complexity, requires low privileges, and user interaction (Patchstack).

The vulnerability has been fixed in version 2.8.3 of the FunnelKit Automation By Autonami plugin. Users are advised to update to this version or later to remove the vulnerability (Patchstack).