CVE-2024-2657: 
WordPress vulnerability analysis and mitigation

The Font Farsi plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-2657) affecting all versions up to and including 1.6.6. The vulnerability was discovered in early 2024 and the plugin was subsequently closed on March 8, 2024 due to security issues (WordPress Plugin, NVD).

The vulnerability stems from insufficient input sanitization and output escaping in the plugin's admin settings. This security flaw allows authenticated users with administrator-level permissions to inject arbitrary web scripts into pages. The injected scripts execute when users access the affected pages. The vulnerability is specifically limited to multi-site installations and installations where unfiltered_html has been disabled. The vulnerability has been assigned a CVSS v3.1 score of 4.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows attackers with administrator access to inject malicious scripts that execute in users' browsers when they visit affected pages. This could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks against site visitors (NVD).

The vulnerability requires an authenticated user with administrator-level permissions to exploit. It specifically affects multi-site installations and installations where unfiltered_html has been disabled, which somewhat limits its scope (NVD).

The plugin has been closed as of March 8, 2024, and is no longer available for download due to security issues. Users are advised to remove the plugin from their WordPress installations (WordPress Plugin).