CVE-2024-2948: 
WordPress vulnerability analysis and mitigation

The Favorites plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-2948. The vulnerability affects all versions up to and including 2.3.3 and is present in the plugin's 'user_favorites' shortcode functionality. This security issue was disclosed on March 30, 2024 (NVD CVE).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes, specifically including the 'no_favorites' attribute in the 'user_favorites' shortcode. The severity of this vulnerability has been rated as HIGH with a CVSS v3.1 base score of 7.2 (Wordfence Intel).

When successfully exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD CVE).

The vulnerability can be exploited by authenticated users with contributor-level permissions or higher. The attack vector requires the attacker to have access to create or edit content using the affected shortcode (NVD CVE).

Users should update to a version newer than 2.3.3 if available. The vulnerability was addressed in a subsequent release through improved input sanitization and output escaping (WordPress Plugin).