CVE-2024-29123: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the Link Library WordPress plugin, affecting versions up to and including 7.6. The vulnerability was identified on March 16, 2024, and was assigned CVE-2024-29123. The affected software is Yannick Lefebvre's Link Library plugin for WordPress (Patchstack, WPScan).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and stems from insufficient input sanitization and output escaping. The CVSS v3.1 scores vary between sources, with NVD rating it at 6.1 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and Patchstack assessing it at 7.1 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) (NVD).

The vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute when users perform specific actions, such as clicking on a malicious link. This could potentially lead to the compromise of user data or session information (WPScan).

The vulnerability requires user interaction to be exploited, as indicated by the CVSS metrics. An attacker needs to successfully trick a user into performing an action, such as clicking on a specially crafted link, to execute the malicious script (Patchstack).

The vulnerability has been fixed in version 7.6.1 of the Link Library plugin. Users are advised to update to this version or later to resolve the security issue. Patchstack has also issued a virtual patch to mitigate this vulnerability by blocking potential attacks until users can update to the fixed version (Patchstack).