CVE-2024-33932: 
WordPress vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in the WordPress Login Logout Register Menu plugin, affecting versions up to 2.0. The vulnerability was identified on December 12, 2023, by researcher Ngô Thiên An (ancorn_ from VNPT-VCI) and was publicly disclosed on April 29, 2024. The vulnerability has been assigned CVE-2024-33932 and affects the plugin developed by Vinod Dalvi (Patchstack Database).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It received a CVSS v3.1 score of 6.5 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires contributor-level privileges or higher to exploit (Patchstack Database).

The vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack Database).

The vulnerability requires an authenticated user with contributor-level privileges or higher to exploit. It has been classified as having a low severity impact and is considered unlikely to be exploited (Patchstack Database).

As of the vulnerability disclosure, no official fix is available for this security issue (Patchstack Database).