CVE-2024-31349: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in the MailMunch – Grow your Email List WordPress plugin, affecting versions up to 3.1.6. The vulnerability was identified on April 5, 2024, and was assigned CVE-2024-31349. This security issue allows for Stored XSS attacks in the plugin's functionality (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It received a CVSS v3.1 base score of 5.4 (Medium) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Patchstack assigned a slightly higher CVSS score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website which will be executed when guests visit the site (Patchstack).

The vulnerability requires a contributor-level privilege to exploit, and has been assessed as having a low priority for patching due to its limited impact and exploitation difficulty (Patchstack).

The vulnerability has been fixed in version 3.1.7 of the MailMunch – Grow your Email List plugin. Users are advised to update to version 3.1.7 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins (Patchstack).