CVE-2024-37263: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in ThemeLooks Enter Addons enteraddons plugin for WordPress, affecting versions up to 2.1.6. The vulnerability was reported on May 22, 2024, and publicly disclosed on June 27, 2024 (Patchstack).

The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting). It received a CVSS v3.1 base score of 5.4 (Medium) from NIST with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Patchstack assessed it at 6.5 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability could allow a malicious actor to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected site (Patchstack).

The vulnerability requires contributor-level privileges to exploit and is considered to have a low priority for patching due to its limited impact. The security issue has been assessed as having a low severity impact and is unlikely to be exploited (Patchstack).

The vulnerability has been fixed in version 2.1.7 of the Enter Addons plugin. Users are advised to update to version 2.1.7 or later to remove the vulnerability (Patchstack).