CVE-2024-29112: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in the WooCommerce Google Feed Manager WordPress plugin, affecting versions up to and including 2.2.0. The vulnerability was disclosed on March 16, 2024, and was assigned CVE-2024-29112. This security issue specifically affects the plugin's web page generation functionality, where insufficient input sanitization and output escaping could lead to stored XSS attacks (Patchstack, WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue, identified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It received a CVSS v3.1 score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The issue specifically affects multi-site installations and installations where unfiltered_html has been disabled (Patchstack).

The vulnerability allows authenticated attackers with Shop Manager-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to unauthorized actions, data theft, or page manipulation (WPScan).

The vulnerability requires an authenticated user with Shop Manager or higher privileges to exploit. It specifically affects multi-site installations and installations where unfiltered_html has been disabled, limiting its potential impact (WPScan).

The vulnerability has been patched in version 2.3.0 of the WooCommerce Google Feed Manager plugin. Users are advised to update to this version or later to resolve the security issue (Patchstack).