CVE-2024-35646: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in the Smartarget Message Bar WordPress plugin, affecting versions through 1.3. The vulnerability was disclosed on May 30, 2024, and was assigned CVE-2024-35646. This security issue allows for Stored XSS attacks in the plugin's functionality (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It received a CVSS v3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L, indicating that it requires high privileges and user interaction to exploit (Patchstack).

The vulnerability could allow a malicious actor to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack).

The vulnerability requires administrator privileges to exploit and has been assessed as having a low priority for patching. The attack complexity is considered low, but the requirement for high privileges makes it less likely to be exploited in the wild (Patchstack).

As of the disclosure date, no official fix is available for this vulnerability. The issue affects versions up to 1.3 of the Smartarget Message Bar plugin (Patchstack).