CVE-2024-3548: 
WordPress vulnerability analysis and mitigation

The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before version 7.1.2 contains a Reflected Cross-Site Scripting vulnerability. This security issue affects high-privilege users such as administrators due to improper sanitization and escaping of parameters before they are output back to the page (NVD, WPScan).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) with a CVSS v3.1 base score of 6.1 (Medium). The attack vector requires network access (AV:N) with low attack complexity (AC:L), no privileges required (PR:N), and user interaction (UI:R). The scope is changed (S:C) with low confidentiality and integrity impact (C:L/I:L) and no availability impact (A:N) (NVD).

When exploited, this vulnerability allows attackers to execute arbitrary web scripts in pages that will be triggered when high-privilege users access the affected pages. This could potentially lead to unauthorized actions being performed under the context of the administrator account (WPScan).

A proof of concept exists demonstrating the vulnerability through the shortcode: [su_lightbox src='123"onmouseover="alert(1)"']Click here to open lightbox[/su_lightbox]. This can be added to a post to trigger the XSS payload (WPScan).

Users should upgrade to version 7.1.2 or later of the Shortcodes Ultimate WordPress plugin to address this vulnerability (WPScan).