CVE-2024-3111: 
WordPress vulnerability analysis and mitigation

The Interactive Content WordPress plugin (H5P) before version 1.15.8 contains a stored Cross-Site Scripting (XSS) vulnerability. The plugin fails to properly validate file uploads, allowing Contributors and users with higher privileges to upload malicious SVG files (WPScan, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) with a CVSS v3.1 base score of 5.4 (Medium) according to NVD, and 7.1 (High) according to CISA-ADP. The vulnerability stems from insufficient validation of SVG file uploads, which can be exploited to inject malicious scripts that execute when the SVG is accessed (WPScan).

When successfully exploited, this vulnerability allows attackers to execute arbitrary JavaScript code in the context of other users' browsers who access the malicious SVG file. This can lead to session hijacking, credential theft, or other malicious actions performed in the context of the affected users (WPScan).

Users are advised to update the H5P (Interactive Content) WordPress plugin to version 1.15.8 or later, which contains the fix for this vulnerability (WPScan).