CVE-2024-27969: 
WordPress vulnerability analysis and mitigation

The Free Downloads WooCommerce plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability (CVE-2024-27969) in versions up to and including 3.5.8.2. The vulnerability was discovered by Abu Hurayra (HurayraIIT) and publicly disclosed on March 13, 2024. The issue affects the WP Enhanced Free Downloads WooCommerce plugin due to insufficient input sanitization and output escaping (WPScan, Patchstack).

The vulnerability is classified as a Stored Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 base score of 6.5 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires an authenticated user with contributor-level access or higher to exploit (WPScan).

This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an injected page, potentially leading to the execution of unauthorized code in users' browsers (Patchstack).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, but user interaction is required for successful exploitation (WPScan).

The vulnerability has been fixed in version 3.5.8.3 of the Free Downloads WooCommerce plugin. Users are advised to update to this version or later to remove the vulnerability (Patchstack).