CVE-2024-35647: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in the WordPress Global Notification Bar plugin, identified as CVE-2024-35647. The vulnerability affects versions through 1.0.1 of the Global Notification Bar plugin and was discovered by Rayhan Ramdhany Hanaputra on April 18, 2024, with public disclosure occurring on May 30, 2024 (Patchstack Database).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) that allows for Stored XSS attacks. It received a CVSS v3.1 base score of 5.9 (Medium), with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires administrator privileges to exploit (Patchstack Database).

The vulnerability could allow a malicious actor to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site (Patchstack Database).

The vulnerability has been assessed as having a low severity impact and is considered unlikely to be exploited. It requires administrator privileges for successful exploitation (Patchstack Database).

As of the latest reports, no official fix is available for this vulnerability. Given the low severity impact and the requirement of administrator privileges, the risk is considered minimal (Patchstack Database).