CVE-2024-2656: 
WordPress vulnerability analysis and mitigation

The Email Subscribers by Icegram Express plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-2656) in versions up to and including 5.7.14. The vulnerability exists due to insufficient input sanitization and output escaping in the CSV import functionality (NVD).

The vulnerability stems from inadequate input sanitization and output escaping mechanisms in the CSV import functionality. It has been assigned a CVSS v3.1 Base Score of 4.4 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. The vulnerability only affects multi-site installations and installations where unfiltered_html has been disabled (Wordfence).

When exploited, this vulnerability allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts into pages. These injected scripts will execute whenever a user accesses the affected page (NVD).

The vulnerability requires an authenticated user with administrator-level permissions to exploit. The attack complexity is considered high, and the scope is changed, indicating that the vulnerability can affect resources beyond its security scope (Wordfence).

A fix has been implemented in the plugin's source code to address the CSV import vulnerability. Users should update to a version newer than 5.7.14 to protect against this security issue (WordPress).