CVE-2024-32582: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Debug Log Manager WordPress plugin, affecting versions up to and including 2.3.1. The vulnerability was assigned CVE-2024-32582 and was publicly disclosed on April 16, 2024. This security issue affects the Bowo Debug Log Manager plugin and allows unauthenticated attackers to perform Stored XSS attacks (WPScan, Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It received a CVSS v3.1 score of 7.1 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The security flaw stems from insufficient input sanitization and output escaping in the plugin's functionality (Patchstack).

This vulnerability allows attackers to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts will execute when users visit the affected pages, potentially compromising the security of both the website and its visitors (Patchstack).

The vulnerability can be exploited by unauthenticated attackers, making it particularly concerning. No user interaction is required for the exploitation, and the attack can be performed remotely (WPScan).

Website administrators are advised to update the Debug Log Manager plugin to version 2.3.2 or later, which contains the fix for this vulnerability. For users of Patchstack, a virtual patch has been issued to mitigate this issue by blocking potential attacks until the update can be applied (Patchstack).