CVE-2024-29142: 
WordPress vulnerability analysis and mitigation

The Better Search – Relevant search results for WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability (CVE-2024-29142) affecting versions up to 3.3.0. The vulnerability was discovered on March 18, 2024, and allows unauthenticated attackers to inject malicious web scripts that execute when users access affected pages (WPScan, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 score of 7.1 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The issue stems from insufficient input sanitization and output escaping in the plugin, allowing attackers to store malicious scripts that execute in users' browsers (Patchstack).

When successfully exploited, this vulnerability allows attackers to inject arbitrary web scripts that execute whenever a user accesses an injected page. This could lead to various malicious activities including redirects, unauthorized advertisements, and other potentially harmful HTML payloads being executed in visitors' browsers (Patchstack).

The vulnerability is particularly concerning as it can be exploited by unauthenticated attackers, requiring no special privileges or user interaction beyond accessing the affected page. The attack complexity is considered low, making it relatively straightforward to exploit (WPScan).

Users are strongly advised to update to version 3.3.1 or later, which contains a fix for this vulnerability. Patchstack has also issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).

The vulnerability was initially reported by security researcher Abdi Pranata on February 20, 2024, and was subsequently published by Patchstack on March 18, 2024. Early warning notifications were sent to Patchstack customers on the same day (Patchstack).