CVE-2024-29811: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the WordPress Radio Player plugin, affecting versions up to and including 2.0.73. The vulnerability was identified on March 25, 2024, and tracked as CVE-2024-29811. The issue affects the SoftLab Radio Player WordPress plugin, which is used for playing live Shoutcast, Icecast, and other audio streams (Patchstack, WPScan).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 6.5 (Medium) from Patchstack. The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating network accessibility, low attack complexity, and required low privileges with user interaction (Patchstack).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page. This could enable attackers to inject malicious scripts, redirects, advertisements, and other HTML payloads that execute when guests visit the affected site (WPScan, Patchstack).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, though user interaction is required for successful exploitation. The vulnerability was initially reported by researcher Khalid Yusuf on November 28, 2023 (Patchstack).

The vulnerability has been fixed in version 2.0.74 of the Radio Player plugin. Users are advised to update to this version or later to remove the vulnerability. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).