CVE-2024-2738: 
WordPress vulnerability analysis and mitigation

The Permalink Manager Lite and Pro plugins for WordPress contain a Reflected Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-2738. The vulnerability affects all versions up to and including 2.4.3.1 and is caused by insufficient input sanitization and output escaping of the 's' parameter in multiple instances. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when users perform actions such as clicking on a link (NVD).

The vulnerability exists due to improper sanitization of the 's' parameter and debug_editor_sql functionality in multiple components. The issue affects both the Posts and Pages sections of the URI Editor. When the debug_editor_sql parameter is present, the application displays an SQL query containing unsanitized user input from the 's' parameter, leading to XSS. The vulnerability has been assigned a CVSS v3.1 score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (Wordfence).

The vulnerability allows attackers to inject malicious web scripts that can execute in the context of other users' browsers. When successfully exploited, it could lead to account takeover, creation of new admin users, or potential webshell uploads if an administrator user is targeted. The impact is particularly severe when chained with unauthorized permalink modification capabilities (GitHub POC).

The vulnerability can be exploited by unauthenticated attackers who can trick users into performing specific actions, such as clicking on a malicious link. Multiple proof-of-concept exploits have been published, demonstrating various attack vectors including exploitation through the URI Editor interface and debug functionality. The vulnerability can also be chained with unauthorized permalink modification for greater impact (GitHub POC).

Users should update to version 2.4.3.2 or later which contains patches for these vulnerabilities. The fix includes proper sanitization of user input and removal of the debug SQL query functionality that was not required for normal operation (WordPress Plugin).