CVE-2024-2696: 
WordPress vulnerability analysis and mitigation

The socialdriver-framework WordPress plugin before version 2024.04.30 contains a stored Cross-Site Scripting (XSS) vulnerability. This security issue affects high-privilege users such as administrators, particularly in multisite setups where the unfiltered_html capability is disallowed (WPScan).

The vulnerability stems from improper sanitization and escaping of certain settings within the plugin. Specifically, the fields in the 'Swift Framework > Instagram Auth' and 'Swift Framework > Google Maps Auth' are vulnerable to XSS attacks. The issue allows for stored XSS payload injection, which executes when the page is reloaded (WPScan).

The vulnerability enables high-privilege users to perform Stored Cross-Site Scripting attacks, even in environments where unfiltered HTML capabilities are restricted. This is particularly significant in multisite WordPress installations where such restrictions are commonly implemented (WPScan).

A proof of concept exists demonstrating the vulnerability. An attacker can exploit this by adding a payload such as ">alert(1) to the vulnerable fields and saving the settings. The XSS payload executes upon page reload (WPScan).

The vulnerability has been patched in version 2024.04.30 of the socialdriver-framework WordPress plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).