CVE-2024-34385: 
WordPress vulnerability analysis and mitigation

The YITH WooCommerce Wishlist plugin contains a Stored Cross-Site Scripting (XSS) vulnerability affecting versions up to 3.32.0. The vulnerability was discovered by Phill Sav (Savphill) and was publicly disclosed on May 30, 2024 (WPScan, Patchstack).

The vulnerability is classified as a Stored Cross-Site Scripting (CWE-79) issue that affects admin settings. It occurs due to insufficient input sanitization and output escaping, particularly in multi-site installations and installations where unfiltered_html has been disabled. The vulnerability has been assigned a CVSS v3.1 score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L (Patchstack).

The vulnerability allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an injected page, potentially leading to unauthorized actions, data theft, or site defacement (WPScan).

The vulnerability requires high privileges (administrator-level access) to exploit, making it less likely to be exploited in the wild. It specifically affects multi-site installations and installations where unfiltered_html has been disabled (WPScan).

The vulnerability has been fixed in version 3.33.0 of the YITH WooCommerce Wishlist plugin. Users are advised to update to this version or later to remove the vulnerability (Patchstack).