CVE-2024-35714: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2024-35714) affects the Theme Freesia Idyllic WordPress theme versions up to and including 1.1.8. It is a Stored Cross-Site Scripting (XSS) vulnerability that allows authenticated users with contributor-level access and above to inject malicious web scripts via the author display name functionality (WPScan, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 5.4 (Medium) from NVD with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Patchstack assigned a slightly higher CVSS score of 6.5 (Medium). The vulnerability stems from insufficient input sanitization and output escaping of the author display name field (Patchstack).

When exploited, this vulnerability allows attackers to inject arbitrary web scripts that will execute whenever a user accesses an injected page. This could potentially lead to the injection of malicious scripts, such as redirects, advertisements, and other HTML payloads that execute when guests visit the affected site (Patchstack).

The vulnerability requires authentication with at least contributor-level access to exploit. The attacker needs to inject malicious scripts through the author display name, which will then be stored and executed when other users view the affected pages (WPScan).

The vulnerability has been fixed in version 1.1.9 of the Idyllic theme. Users are advised to update to this version or later to remove the vulnerability (Patchstack).