CVE-2024-30432: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the WordPress plugin B Slider - Slider for your block editor, affecting versions up to 1.1.12. The vulnerability was identified on March 28, 2024, and was assigned CVE-2024-30432. The security researcher Jean Tirstan T reported this vulnerability (Wordfence, WPScan).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and received a CVSS v3.1 score of 6.5 (Medium). The issue stems from insufficient input sanitization and output escaping in the plugin's functionality. The vulnerability requires an authenticated user with contributor-level access or higher to exploit (Patchstack).

If exploited, this vulnerability allows attackers to inject malicious scripts that execute when users access the affected pages. The injected scripts could potentially be used for redirects, displaying unwanted advertisements, or executing other malicious HTML payloads on the website (Patchstack).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, but it does require user interaction for successful exploitation (WPScan).

The vulnerability has been fixed in version 1.1.13 of the B Slider plugin. Website administrators are advised to update to this version or later to remove the vulnerability. The security issue is considered to have a low severity impact and is unlikely to be exploited (Patchstack).