CVE-2024-29125: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-site Scripting (XSS) vulnerability has been identified in the WordPress Coupon Affiliates plugin, affecting versions up to 5.12.7. The vulnerability was discovered on January 27, 2024, and publicly disclosed on March 16, 2024. This security issue impacts the RelyWP Coupon Affiliates plugin for WordPress installations (Patchstack).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue, specifically an Improper Neutralization of Input During Web Page Generation. It has been assigned a CVSS v3.1 score of 7.1 (High), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability is tracked as CWE-79 and requires no authentication to exploit (Patchstack).

This vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into affected websites. These injected scripts would be executed when visitors access the compromised site. The vulnerability has been confirmed to be actively exploited in the wild (Patchstack).

The vulnerability is considered moderately dangerous and is expected to become widely exploited. It requires no authentication to exploit, making it particularly concerning. Attackers typically automate attacks against such vulnerabilities to compromise as many websites as possible before users have time to apply patches (Patchstack).

The vulnerability has been patched in version 5.12.8 of the Coupon Affiliates plugin. Users are strongly advised to update to this version or later immediately. For users of Patchstack, a virtual patch has been issued to mitigate this issue by blocking potential attacks until the update can be applied (Patchstack).