CVE-2024-25916: 
WordPress vulnerability analysis and mitigation

The My Calendar WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-25916. This security issue affects versions up to and including 3.4.23 of the plugin. The vulnerability was discovered by Steven Julian and publicly disclosed on February 11, 2024. The issue specifically impacts the plugin's shortcode functionality and requires an authenticated user with contributor-level access or higher to exploit (WPScan, Patchstack).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcode functionality. It has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation (Patchstack).

This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to various attacks including malicious redirects, unauthorized advertisements, and other HTML payload injections (WPScan, Patchstack).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, but user interaction is required for successful exploitation, as reflected in the CVSS metrics (Patchstack).

The vulnerability has been patched in version 3.4.24 of the My Calendar plugin. Users are advised to update to this version or later to resolve the security issue. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).