CVE-2024-34560: 
WordPress vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability has been identified in GOMO gee Search Plus WordPress plugin versions through 1.4.4. The vulnerability was discovered by Sharanabasappa and was assigned CVE-2024-34560. The issue was reported on April 5, 2024, and publicly disclosed on May 7, 2024 (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has been assigned a CVSS v3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires administrator privileges to exploit (Patchstack).

If exploited, this vulnerability could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website which will be executed when guests visit the site (Patchstack).

The vulnerability requires administrator privileges to exploit, which significantly reduces its potential impact. The software is considered likely abandoned as it has not received updates for over a year (Patchstack).

As there is no official fix available, the recommended action is to remove and replace the software with an alternative solution. The plugin appears to be abandoned, having not received updates for over a year, making it unlikely to receive security fixes in the future (Patchstack).