CVE-2024-30448: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in the Supsystic Slider WordPress plugin, affecting versions up to 1.8.10. The vulnerability was reported on February 3, 2024, and publicly disclosed on March 28, 2024. This security issue has been assigned CVE-2024-30448 and allows for Stored XSS attacks (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It received a CVSS v3.1 score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires administrator privileges to exploit (Patchstack).

This vulnerability could allow a malicious actor to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack).

The vulnerability requires administrator-level access to exploit, which significantly reduces its risk profile. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability has been patched in version 1.8.11 of the Slider by Supsystic plugin. Users are advised to update to version 1.8.11 or later to remediate this security issue (Patchstack).