CVE-2024-29134: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Themefic Tourfic WordPress plugin, affecting versions through 2.11.8. The vulnerability was identified on March 18, 2024, and was assigned CVE-2024-29134 (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It received a CVSS v3.1 base score of 5.4 (Medium) from NVD with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Patchstack assessed it with a score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (NVD).

This vulnerability could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website which will be executed when guests visit the site. The impact requires user interaction and authenticated access with Contributor or higher privileges (Patchstack).

The vulnerability requires authenticated access with Contributor or higher privileges to exploit. It was reported by researcher LVT-tholv2k on January 29, 2024, and was publicly disclosed on March 18, 2024 (Patchstack).

The vulnerability has been fixed in version 2.11.9 of the Tourfic plugin. Users are advised to update to version 2.11.9 or later to remove the vulnerability (Patchstack).