CVE-2024-37536: 
WordPress vulnerability analysis and mitigation

A stored Cross-site Scripting (XSS) vulnerability was discovered in Web357 Easy Custom Code (LESS/CSS/JS) – Live editing plugin for WordPress, affecting versions up to 1.0.8. The vulnerability was reported on February 29, 2024, and publicly disclosed on July 5, 2024 (Patchstack).

The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). It received a CVSS v3.1 Base Score of 5.4 (Medium) from NVD with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Patchstack assigned it a score of 5.9 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website which will be executed when guests visit the site. The impact is considered low severity and is unlikely to be exploited (Patchstack).

The vulnerability requires administrator privileges to exploit and user interaction. The attack vector is network-based, with low attack complexity (NVD).

The vulnerability has been fixed in version 1.0.9 of the plugin. Users are advised to update to version 1.0.9 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins (Patchstack).