CVE-2024-31104: 
WordPress vulnerability analysis and mitigation

The GetResponse for WordPress plugin version 5.5.35 and earlier contains a Stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-31104. The vulnerability was discovered by Ngô Thiên An (ancorn_) and publicly disclosed on March 29, 2024. This security issue affects WordPress installations using the GetResponse plugin and allows authenticated users with contributor-level access or higher to inject malicious web scripts (WPScan, Patchstack).

The vulnerability stems from insufficient input sanitization and output escaping in the GetResponse WordPress plugin. This allows authenticated attackers with contributor-level privileges to inject arbitrary web scripts into pages. The vulnerability has been assigned a CVSS score of 6.5 (Low severity) and is classified under OWASP Top 10 category A3: Injection (Patchstack).

When exploited, this vulnerability allows malicious actors to inject scripts that will execute whenever a user accesses an affected page. This could lead to various attacks including malicious redirects, unauthorized advertisements, and execution of other HTML payloads on the website (Patchstack).

The vulnerability requires an authenticated user with at least contributor-level access to exploit. While this requirement somewhat limits the potential attack surface, it still presents a significant risk for WordPress installations where contributor access is granted to multiple users (WPScan).

Currently, there is no official fix available for this vulnerability. The security issue has been classified as having a low severity impact and is considered unlikely to be exploited (Patchstack).