CVE-2024-32548: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the What's New Generator WordPress plugin, affecting versions up to and including 2.0.2. The vulnerability was identified on April 15, 2024, and was assigned CVE-2024-32548. This security issue specifically impacts the plugin's admin settings functionality (WPScan, Patchstack).

The vulnerability stems from insufficient input sanitization and output escaping in the plugin's admin settings. It has been assigned a CVSS v3.1 score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The issue is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (Patchstack).

The vulnerability allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an injected page. The impact is particularly significant in multi-site installations and installations where unfiltered_html has been disabled (WPScan).

The vulnerability requires administrator-level access to exploit, which significantly limits its potential impact. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

Currently, there is no official fix available for this vulnerability. The issue affects versions up to and including 2.0.2, and no patched version has been released yet (Patchstack).