CVE-2024-3752: 
WordPress vulnerability analysis and mitigation

The Crelly Slider WordPress plugin through version 1.4.5 contains a stored Cross-Site Scripting (XSS) vulnerability. This security issue was discovered and publicly disclosed on April 15, 2024, and was assigned CVE-2024-3752. The vulnerability affects the plugin's settings functionality and impacts WordPress installations using the Crelly Slider plugin (WPScan).

The vulnerability stems from improper sanitization and escaping of certain plugin settings. The issue specifically affects the 'callback' field in the slider settings. The vulnerability has been assigned a CVSS 3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. It is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (CISA-ADP).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, even when the unfiltered_html capability is disallowed (for example in multisite setup). This could potentially lead to the execution of malicious JavaScript code in users' browsers (WPScan).

The vulnerability can be exploited by accessing the Crelly Slider settings, adding a slider, and inserting malicious JavaScript code in the 'callback' field. The attack requires administrative privileges and user interaction. A proof of concept exists demonstrating the execution of arbitrary JavaScript code through the 'alert(1)' payload (WPScan).

Currently, there is no known fix available for this vulnerability in the Crelly Slider WordPress plugin (WPScan).