CVE-2024-29777: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in WPMU DEV's Forminator plugin, tracked as CVE-2024-29777. The vulnerability affects all versions of Forminator up to and including version 1.29.0. This security issue was discovered by Rafie Muhammad and was publicly disclosed on March 25, 2024 (Patchstack Report).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation, specifically a Reflected Cross-Site Scripting (CWE-79) issue. It has received a CVSS v3.1 base score of 6.1 (Medium) from NIST and 7.1 (High) from Patchstack, with the following vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating that the vulnerability is network-accessible and requires user interaction (NVD).

If exploited, this vulnerability could allow attackers to inject malicious scripts into the website, which would then be executed when users visit the affected pages. This could lead to various malicious activities including redirects, unauthorized advertisements, and other potentially harmful HTML payloads being executed in users' browsers (Patchstack Report).

The vulnerability is known to be exploitable and requires no authentication to exploit. The attack vector is considered low complexity, requiring user interaction to trigger the malicious payload (Patchstack Report).

The vulnerability has been patched in Forminator version 1.29.1. Users are strongly advised to update to this version or later to resolve the security issue. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks (Patchstack Report).