CVE-2024-35719: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in MagniGenie RestroPress WordPress plugin, affecting versions up to 3.1.2.1. The vulnerability was disclosed on June 8, 2024, and was assigned the identifier CVE-2024-35719. The issue stems from improper neutralization of input during web page generation (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It received a CVSS v3.1 base score of 5.4 (Medium) from NIST with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Patchstack assigned a CVSS score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability allows malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website, which will be executed when guests visit the site. The stored nature of the XSS makes it particularly concerning as the malicious payload persists on the server (Patchstack).

The vulnerability requires a contributor-level user account to exploit, indicating that authentication is necessary. The attack complexity is considered low, requiring minimal access conditions to be exploited (Patchstack).

The vulnerability has been patched in version 3.1.2.2 of the RestroPress plugin. Users are advised to update to this version or later to remediate the security issue (Patchstack).