CVE-2024-35641: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in the GregRoss Just Writing Statistics WordPress plugin, affecting versions up to 4.5. The vulnerability was identified on April 25, 2024, by security researcher Rayhan Ramdhany Hanaputra and was assigned CVE-2024-35641. The issue was publicly disclosed on May 30, 2024 (Patchstack Report).

The vulnerability is classified as a Stored Cross-site Scripting (XSS) issue, stemming from improper neutralization of input during web page generation. It has been assigned a CVSS v3.1 base score of 5.9 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The vulnerability is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation) (Patchstack Report).

This vulnerability could allow a malicious actor to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site. The impact requires administrator privileges to exploit, which somewhat limits its potential scope (Patchstack Report).

The vulnerability requires administrator-level privileges to exploit, indicating a higher barrier to entry for potential attackers. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited in the wild (Patchstack Report).

The vulnerability has been fixed in version 4.6 of the Just Writing Statistics plugin. Users are advised to update to version 4.6 or later to remove the vulnerability. Patchstack users have the option to enable auto-updates for vulnerable plugins (Patchstack Report).