CVE-2024-27991: 
WordPress vulnerability analysis and mitigation

A Stored Cross-site Scripting (XSS) vulnerability was discovered in the SupportCandy WordPress plugin affecting versions up to 3.2.3. The vulnerability was reported on January 20, 2024, and publicly disclosed on March 15, 2024 (Patchstack).

The vulnerability is classified as a Cross-site Scripting (XSS) issue, specifically of the stored variety. It has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability is tracked as CVE-2024-27991 and falls under the CWE-79 category (Improper Neutralization of Input During Web Page Generation) (Patchstack).

This vulnerability could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website which will be executed when guests visit the site. The attack requires subscriber-level privileges to exploit (Patchstack).

The vulnerability requires a low level of access (subscriber privileges) to exploit. It has been assigned a medium priority for patching, indicating a moderate likelihood of exploitation (Patchstack).

The vulnerability has been fixed in version 3.2.4 of the SupportCandy plugin. Users are advised to update to this version or later immediately. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks (Patchstack).