CVE-2024-32723: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability has been identified in Code Tides Advanced Floating Content WordPress plugin, tracked as CVE-2024-32723. The vulnerability affects versions through 1.2.5 of the Advanced Floating Content plugin and was discovered on April 22, 2024. This security issue allows for Stored XSS attacks when an authenticated user with Editor or higher privileges accesses the affected functionality (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The security issue specifically relates to stored cross-site scripting, requiring authenticated access with Editor or higher privileges to exploit (Patchstack).

If exploited, this vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack).

The vulnerability requires an authenticated user with Editor or higher privileges to exploit, which significantly reduces the risk of widespread exploitation. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability has been patched in version 1.2.6 of the Advanced Floating Content plugin. Users are advised to update to version 1.2.6 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins as an additional security measure (Patchstack).