CVE-2024-27188: 
WordPress vulnerability analysis and mitigation

CVE-2024-27188 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Cloudways Breeze WordPress plugin affecting versions through 2.1.3. The vulnerability was discovered by Jorge Diaz (ddiax) and was publicly disclosed on March 25, 2024 (Patchstack).

The vulnerability stems from improper neutralization of input during web page generation, specifically in the breeze_api_token settings. This security issue allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, even when the unfiltered_html capability is disallowed, such as in multisite setups. The vulnerability has been assigned a CVSS v3.1 score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L (WPScan).

The vulnerability could allow malicious actors with administrative access to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would then be executed when guests visit the affected site (Patchstack).

The vulnerability requires high privileges (administrator access) to exploit and user interaction for the attack to succeed. It has been classified as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability has been fixed in version 2.1.4 of the Breeze plugin. Users are advised to update to version 2.1.4 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins as an additional security measure (Patchstack).