CVE-2024-32577: 
WordPress vulnerability analysis and mitigation

The CBX Bookmark & Favorite WordPress plugin contains a Cross-site Scripting (XSS) vulnerability affecting versions up to 1.7.21. The vulnerability was discovered on April 16, 2024, and was assigned CVE-2024-32577. This security issue affects the cbxwpbookmark component of the plugin and allows for Stored XSS attacks (WPScan, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The issue stems from insufficient input sanitization and output escaping on user-supplied attributes (WPScan).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to information disclosure, session hijacking, or other malicious actions (WPScan).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, requiring user interaction for successful exploitation (Patchstack).

The vulnerability has been fixed in version 1.7.22 of the CBX Bookmark & Favorite plugin. Users are advised to update to this version or later to remediate the security issue (WPScan).