CVE-2024-2958: 
WordPress vulnerability analysis and mitigation

The SVS Pricing Tables plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-2958) affecting all versions up to and including 1.0.4. The vulnerability was discovered and disclosed on May 2, 2024, impacting WordPress installations with the SVS Pricing Tables plugin installed (NVD).

The vulnerability stems from insufficient input sanitization and output escaping in the pricing table settings functionality. It has been assigned a CVSS v3.1 base score of 4.8 (Medium) by NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, while Wordfence assigned a score of 4.4 (Medium) with vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

When exploited, this vulnerability allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page. The impact is specifically limited to multi-site installations and installations where unfiltered_html has been disabled (NVD).

The vulnerability requires an authenticated user with administrator-level permissions to exploit. While the attack complexity is considered low, the requirement for high-level privileges reduces the overall exploitability risk (NVD).