CVE-2024-3554: 
WordPress vulnerability analysis and mitigation

The All in One SEO WordPress plugin (versions up to 4.6.0) contains a Stored Cross-Site Scripting vulnerability (CVE-2024-3554) discovered on April 29, 2024. The vulnerability affects the plugin's shortcode functionality and stems from insufficient input sanitization and output escaping on user-supplied attributes (WPScan, NVD).

The vulnerability has been assigned a CVSS v3.1 score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The issue specifically affects the plugin's shortcode functionality, where insufficient input sanitization and output escaping of user-supplied attributes can lead to stored XSS attacks. A proof of concept demonstrates that the vulnerability can be exploited using the shortcode [aioseo_html_sitemap] with malicious attributes (WPScan).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever any user accesses the compromised page, potentially leading to session hijacking, credential theft, or other client-side attacks (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack can be executed by injecting malicious scripts through the plugin's shortcode attributes, which will then be stored and executed when other users access the affected pages (WPScan).

The vulnerability has been patched in version 4.6.1.1 of the All in One SEO plugin. Site administrators are strongly advised to update to this version or later to protect against potential attacks (WPScan).