CVE-2024-2968: 
WordPress vulnerability analysis and mitigation

The WP-Eggdrop plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-2968) affecting all versions up to and including 0.1. The vulnerability was discovered and reported by Benedictus Jovan (aillesiM) on March 28, 2024 (Wordfence, NVD).

The vulnerability stems from insufficient input sanitization and output escaping in the admin settings of the WP-Eggdrop plugin. This security flaw has been assigned a CVSS v3.1 base score of 4.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts into pages. These injected scripts will execute whenever a user accesses the affected page. The scope is limited to multi-site installations and installations where unfiltered_html has been disabled (NVD).

The vulnerability requires an authenticated user with administrator-level permissions to exploit. The attack complexity is considered high, and user interaction is not required for exploitation (NVD).