CVE-2024-35675: 
WordPress vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in ILLID Advanced Woo Labels WordPress plugin, affecting versions up to 1.93. The vulnerability was disclosed on June 5, 2024, and was assigned the identifier CVE-2024-35675. The issue stems from improper neutralization of input during web page generation (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) by NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Patchstack assessed it with a score of 6.5 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

The vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website, which would be executed when visitors access the site (Patchstack).

The vulnerability requires a low level of privilege (Contributor or higher) to exploit, with low attack complexity. User interaction is required for successful exploitation (NVD).

The vulnerability has been fixed in version 1.94 of the Advanced Woo Labels plugin. Users are advised to update to version 1.94 or later to remove the vulnerability. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).