CVE-2024-37429: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the WordPress Login with phone number plugin, tracked as CVE-2024-37429. The vulnerability affects versions up to 1.7.35 of the Hamid Alinia – idehweb Login with phone number plugin. The issue was discovered and reported by security researcher LuxF0z on June 10, 2024, and was publicly disclosed on June 28, 2024 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79). It received a CVSS v3.1 base score of 4.8 (Medium) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, while Patchstack assigned it a slightly higher score of 5.9 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability allows authenticated users with administrator privileges to inject malicious scripts into the website. These scripts could be used to create redirects, insert unwanted advertisements, or execute other HTML payloads that would affect visitors to the site (Patchstack).

The vulnerability requires high privileges (administrator access) to exploit, and user interaction is necessary for successful exploitation. While the vulnerability has been publicly disclosed, there are no known reports of it being actively exploited in the wild (NVD).

The vulnerability has been patched in version 1.7.36 of the plugin. Website administrators are advised to update to version 1.7.36 or later to remediate this security issue. The security issue is considered to have a low severity impact and is unlikely to be exploited (Patchstack).