CVE-2024-35765: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2024-35765) is a Stored Cross-Site Scripting (XSS) issue affecting the Greenshift – animation and page builder blocks WordPress plugin in versions up to 8.8.9.1. The vulnerability was discovered on June 17, 2024, and was fixed in version 8.9.4. The issue specifically affects the plugin's social share block functionality (WPScan, Patchstack).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's social share block. It has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (WPScan).

This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to session hijacking, defacement, or other malicious actions (WPScan).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, but user interaction is required for successful exploitation (Patchstack).

The recommended mitigation is to update the Greenshift – animation and page builder blocks plugin to version 8.9.4 or later, which contains the security fix for this vulnerability (Patchstack).