CVE-2024-2908: 
WordPress vulnerability analysis and mitigation

The Call Now Button WordPress plugin before version 1.4.7 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered on April 5, 2024, and was assigned CVE-2024-2908. The issue affects the plugin's settings functionality, specifically impacting WordPress installations where high-privilege users such as administrators are present (WPScan).

The vulnerability stems from improper sanitization and escaping of certain settings within the plugin. This security flaw allows for stored XSS attacks to be performed even when the unfiltered_html capability is disallowed, which is particularly relevant in multisite setups. The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L (NVD).

When exploited, this vulnerability could allow high-privilege users to execute stored Cross-Site Scripting attacks. The impact is particularly concerning in multisite WordPress installations where the unfiltered_html capability is typically restricted (WPScan).

The vulnerability can be exploited by navigating to All Buttons, adding a button, selecting 'Button action' as Link, and inserting a malicious JavaScript payload. The exploit is triggered when users visit the website and click on the compromised button (WPScan).

The vulnerability has been patched in version 1.4.7 of the Call Now Button plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).