CVE-2024-34415: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in ThimPress Thim Elementor Kit WordPress plugin, affecting versions up to 1.1.8. The vulnerability was disclosed on May 6, 2024, and was assigned CVE-2024-34415 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It received a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (Patchstack).

This vulnerability could allow a malicious actor to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected site (Patchstack).

The vulnerability requires Contributor-level privileges to exploit, and is classified as having a low priority for patching. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).

The vulnerability has been fixed in version 1.1.9 of the Thim Elementor Kit plugin. Users are advised to update to version 1.1.9 or later to remove the vulnerability (Patchstack).

The vulnerability was initially reported by security researcher 4rCanJ0x! on April 8, 2024. Early warning was sent out to Patchstack customers on May 6, 2024, before the public disclosure on May 8, 2024 (Patchstack).