CVE-2024-32533: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Peter Shaw's LH Add Media From Url WordPress plugin affecting versions through 1.22. The vulnerability was discovered and published on April 15, 2024 (Patchstack).

The vulnerability has been assigned CVE-2024-32533 and received a CVSS v3.1 base score of 7.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The issue is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (Patchstack).

This vulnerability could allow malicious actors to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website which will be executed when guests visit the site (Patchstack).

The vulnerability is unauthenticated, meaning it can be exploited without requiring user authentication. It is considered moderately dangerous and expected to become exploited (Patchstack).

Users are advised to update to version 1.23 or later to resolve the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users update to a fixed version (Patchstack).