CVE-2024-32457: 
WordPress vulnerability analysis and mitigation

The Elements Plus! WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability (CVE-2024-32457) affecting versions up to and including 2.16.3. The vulnerability was discovered by researcher Khalid and publicly disclosed on April 15, 2024. The issue stems from insufficient input sanitization and output escaping on user-supplied attributes (WPScan, Patchstack).

The vulnerability is classified as a Stored Cross-Site Scripting (CWE-79) with a CVSS v3.1 score of 6.5 (Medium), using the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The issue requires an authenticated user with contributor-level access or higher to exploit (Patchstack).

When exploited, this vulnerability allows authenticated attackers with contributor-level access to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to session hijacking, defacement, or other malicious actions (WPScan).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, but user interaction is required for successful exploitation (Patchstack).

The vulnerability has been patched in version 2.16.4 of the Elements Plus! plugin. Users are advised to update to this version or later to remediate the security issue (Patchstack).