CVE-2024-34770: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Popup Maker WP WordPress plugin, affecting versions through 1.2.8. The vulnerability was identified on May 17, 2024, and was assigned CVE-2024-34770. This security issue affects the Popup Maker WP plugin, which is used for creating responsive popups and email opt-ins in WordPress websites (Patchstack, WPScan).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) with a CVSS v3.1 score of 6.5 (Medium). The security issue stems from insufficient input sanitization and output escaping in the plugin's functionality. The vulnerability affects users with subscriber-level access and above (Patchstack).

When exploited, this vulnerability allows authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to session hijacking, defacement, or other malicious actions (WPScan).

The vulnerability requires an authenticated user with at least subscriber-level privileges to exploit. The attack complexity is considered low, requiring user interaction for successful exploitation (Patchstack).

The vulnerability has been patched in version 1.3.7 of the Popup Maker WP plugin. Website administrators are advised to update to this version or later to resolve the security issue. For users unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks (Patchstack).