CVE-2024-37489: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the OceanWP Ocean Extra WordPress plugin, affecting versions up to and including 2.2.9. The vulnerability was disclosed on July 4, 2024, and tracked as CVE-2024-37489. This security issue affects the plugin's web page generation functionality due to insufficient input sanitization and output escaping (Patchstack, WPScan).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 5.4 (Medium) from NVD with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Patchstack assigned a slightly higher CVSS score of 6.5 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires contributor-level access or higher to exploit (NVD).

The vulnerability allows authenticated attackers with contributor-level access or above to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to data theft, session hijacking, or other malicious actions (WPScan).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, requiring user interaction for successful exploitation (NVD).

The vulnerability has been patched in version 2.3.0 of the Ocean Extra plugin. Users are advised to update to this version or later to resolve the security issue (Patchstack).