CVE-2024-27993: 
WordPress vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in Typps Calendarista Basic Edition WordPress plugin, affecting versions through 3.0.2. The vulnerability was initially reported on January 18, 2024, by researcher Mochamad Sofyan and was publicly disclosed on March 15, 2024. The vulnerability has been assigned CVE-2024-27993 and is related to improper neutralization of input during web page generation (Patchstack).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue (CWE-79) that allows for improper neutralization of input during web page generation. It has received a CVSS v3.1 base score of 7.1 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability can be exploited without authentication, making it particularly concerning (Patchstack).

This vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the affected website. These injected scripts would be executed when guests visit the site, potentially compromising the security of both the website and its visitors (Patchstack).

The vulnerability is known to be exploited in the wild and is considered moderately dangerous. The unauthenticated nature of the exploit makes it particularly accessible to potential attackers, and the vulnerability is expected to become more widely exploited (Patchstack).

Users are advised to update to version 3.0.3 or later of the Calendarista Basic Edition plugin to resolve the vulnerability. For users of Patchstack, a virtual patch has been issued to mitigate this issue by blocking potential attacks until the update can be applied (Patchstack).