CVE-2024-29761: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in the WordPress WP Post Disclaimer plugin, affecting versions up to 1.0.3. The vulnerability was identified on March 25, 2024, and was assigned CVE-2024-29761. The issue allows for Stored XSS attacks in the Krunal Prajapati WP Post Disclaimer plugin (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79). It received a CVSS v3.1 score of 6.5 (Medium), with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires Contributor-level privileges to exploit (Patchstack).

This vulnerability could allow a malicious actor to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected site (Patchstack).

The vulnerability requires Contributor-level privileges to exploit, indicating that an attacker would need some level of authenticated access to the WordPress installation. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability has been patched in version 1.0.4 of the WP Post Disclaimer plugin. Users are advised to update to version 1.0.4 or later to remediate the vulnerability. Patchstack users can enable auto-update functionality for vulnerable plugins (Patchstack).