CVE-2024-35701: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in PropertyHive WordPress plugin affecting versions through 2.0.13. The vulnerability was identified and disclosed on June 8, 2024, and was assigned CVE-2024-35701 (NVD).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It received a CVSS v3.1 base score of 5.4 (Medium) from NVD with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Patchstack assessed it with a slightly higher CVSS score of 6.5 (Medium) (Patchstack).

The vulnerability allows malicious actors to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website which will be executed when guests visit the site. The stored nature of the XSS makes it particularly concerning as the malicious payload persists on the server (Patchstack).

The vulnerability requires an attacker to have contributor-level privileges to exploit. It has been classified as having a low priority for exploitation, though the stored nature of the XSS makes it a persistent threat once successfully exploited (Patchstack).

The vulnerability has been fixed in PropertyHive version 2.0.14. Users are advised to update to version 2.0.14 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins as an additional security measure (Patchstack).