CVE-2024-32553: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the WordPress Superfly Menu plugin, affecting versions up to and including 5.0.25. The vulnerability was discovered by Dave Jong from Patchstack and was assigned CVE-2024-32553. This security issue was publicly disclosed on April 16, 2024 (Patchstack Report).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It has received a CVSS v3.1 base score of 7.1 (High) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's functionality (WPScan).

The vulnerability allows authenticated attackers with subscriber-level access or higher to inject malicious scripts into web pages. When executed, these scripts can potentially lead to various malicious activities including page redirects, unauthorized advertisements, and other HTML payload executions that affect site visitors (Patchstack Report).

The vulnerability is known to be exploitable by authenticated users with subscriber-level privileges or higher. According to Patchstack's assessment, this vulnerability is moderately dangerous and is expected to become actively exploited (Patchstack Report).

Currently, there is no official fix available from the plugin developer. However, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until an official fix becomes available. Website administrators are advised to implement the virtual patch immediately to protect their sites (Patchstack Report).