CVE-2024-33548: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in AA-Team WZone WordPress plugin affecting versions through 14.0.10. The vulnerability was discovered by Rafie Muhammad and was assigned CVE-2024-33548. The issue was published on April 25, 2024, and has been given a CVSS v3.1 base score of 7.1 (High) (Patchstack).

The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). It has been assigned a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating that it is network-accessible, requires low attack complexity, needs no privileges, but does require user interaction (NVD).

This vulnerability could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website which will be executed when guests visit the site (Patchstack).

The vulnerability is known to be exploitable and is considered moderately dangerous. It is expected to become actively exploited in the wild (Patchstack).

The vulnerability has been fixed in version 14.1.00. Users are advised to update to version 14.1.00 or later to remove the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users have updated to a fixed version (Patchstack).