CVE-2024-32711: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the WordPress myCred plugin versions through 2.6.3. The vulnerability was discovered on February 17, 2024, and publicly disclosed on April 22, 2024. This security issue affects users with Contributor or higher privileges in WordPress installations using the vulnerable myCred plugin versions (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating that it requires low attack complexity but needs user interaction and authenticated access to exploit (Patchstack).

The vulnerability could allow authenticated attackers to inject malicious scripts into the website, which would then be executed when other users visit affected pages. This could lead to various malicious activities including redirects, unauthorized advertisements, and execution of other malicious HTML payloads (Patchstack).

The vulnerability requires an attacker to have at least Subscriber-level privileges to exploit. It has been reported that this vulnerability is known to be exploited in the wild (Patchstack).

Users are advised to update to myCred version 2.6.4 or later to resolve this vulnerability. For those unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until the update can be applied (Patchstack).