CVE-2024-29795: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in Interfacelab Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more plugin, affecting versions up to 4.5.24. The vulnerability was reported on December 11, 2023, by Ngô Thiên An (ancorn_ from VNPT-VCI) and was publicly disclosed on March 25, 2024 (Patchstack).

The vulnerability is classified as a Stored XSS issue (CWE-79: Improper Neutralization of Input During Web Page Generation) with a CVSS v3.1 base score of 6.5 (Medium). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating network accessibility, low attack complexity, required low privileges, and user interaction (Patchstack).

This vulnerability could allow a malicious actor to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website, which would be executed when visitors access the site. The impact is considered to have low severity but affects confidentiality, integrity, and availability of the system (Patchstack).

The vulnerability requires contributor-level privileges to exploit, making it less likely to be exploited in the wild. The security issue has been assessed as having a low severity impact (Patchstack).

The vulnerability has been fixed in version 4.5.25 of the plugin. Users are advised to update to version 4.5.25 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins (Patchstack).