CVE-2024-29906: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the WordPress Meta Data and Taxonomies Filter (MDTF) plugin affecting versions through 1.3.2. The vulnerability was identified and disclosed on March 25, 2024, by researcher LVT-tholv2k (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 5.4 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The vulnerability requires authenticated access with Contributor-level privileges or higher (NVD).

This vulnerability could allow authenticated attackers to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected pages (Patchstack).

The vulnerability requires an authenticated user with at least Contributor-level access to exploit. It has been classified as having a low priority for patching, suggesting a relatively lower risk of exploitation (Patchstack).

The vulnerability has been fixed in version 1.3.3 of the plugin. Users are advised to update to this version or later to remediate the issue. Additionally, Patchstack has issued a virtual patch to mitigate this vulnerability by blocking potential attacks until users can update to the fixed version (Patchstack).