CVE-2024-31357: 
WordPress vulnerability analysis and mitigation

The Ultimate Store Kit Elementor Addons plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability (CVE-2024-31357) affecting versions up to and including 1.5.2. The vulnerability was discovered by Ray Wilson and publicly disclosed on April 8, 2024 (Patchstack, WPScan).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The issue stems from insufficient input sanitization and output escaping in the plugin (Patchstack).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized actions, data theft, or site defacement (WPScan).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, requiring user interaction for successful exploitation (Patchstack).

The vulnerability has been fixed in version 1.6.0 of the Ultimate Store Kit Elementor Addons plugin. Users are advised to update to this version or later to remove the vulnerability (Patchstack).