CVE-2024-3628: 
WordPress vulnerability analysis and mitigation

The EasyEvent WordPress plugin through version 1.0.0 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and publicly disclosed on April 16, 2024, and was assigned CVE-2024-3628. The issue affects the plugin's settings functionality and impacts WordPress installations using the EasyEvent plugin (WPScan).

The vulnerability stems from improper sanitization and escaping of settings within the plugin. This security flaw allows high-privilege users, such as administrators, to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disabled. The vulnerability has been classified as XSS with a CVSS score of 3.5 (low severity) and is mapped to CWE-79 (WPScan).

When exploited, this vulnerability could allow authenticated administrators to execute arbitrary JavaScript code in the context of other users' browsers who access the affected pages. This could potentially lead to session hijacking, defacement, or other malicious actions depending on the executed payload (WPScan).

The vulnerability can be exploited by accessing the plugin's settings page at '/wp-admin/options-general.php?page=easyevent' and inserting malicious JavaScript code in the ID field. The attack requires administrator-level access to the WordPress installation (WPScan).

Currently, there is no known fix available for this vulnerability. Website administrators using the EasyEvent plugin should consider either removing the plugin or implementing additional security controls to restrict access to the plugin's settings page (WPScan).