CVE-2024-37558: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the WPFavicon WordPress plugin, affecting versions through 2.1.1. The vulnerability was discovered by researcher Cronus and was disclosed on July 21, 2024. This security issue impacts the WPFavicon plugin developed by Nazmul Hossain Nihal (NVD, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 4.8 (Medium) from NVD and 5.9 (Medium) from Patchstack. The attack vector is network-based (AV:N), requires high privileges (PR:H), and user interaction (UI:R). The scope is changed (S:C) with low impacts on confidentiality and integrity (NVD).

The vulnerability allows for Stored Cross-Site Scripting attacks, which could enable attackers to inject malicious scripts that persist on the target system. This can lead to potential compromise of user sessions, data theft, or manipulation of website content when accessed by authenticated users (Patchstack).

The vulnerability requires high privileges for exploitation and user interaction, suggesting that an attacker would need administrative access to the WordPress installation to successfully exploit the vulnerability. This significantly limits the potential attack surface (NVD).

Currently, there is no official fix available for this vulnerability. Users of the affected WPFavicon plugin versions (through 2.1.1) should consider implementing additional security controls or temporarily disabling the plugin until a patch is released (Patchstack).