CVE-2024-37949: 
WordPress vulnerability analysis and mitigation

The CVE-2024-37949 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in CyberChimps Responsive Mobile WordPress theme, affecting versions up to and including 1.15.1. The vulnerability was publicly disclosed on July 10, 2024, and was identified by security researcher stealthcopter (WPScan, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The issue stems from insufficient input sanitization and output escaping in the theme's code (Patchstack).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to unauthorized actions, data theft, or site defacement (WPScan).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, requiring user interaction for successful exploitation (Patchstack).

Currently, there is no official fix available for this vulnerability. The software is considered abandoned as it hasn't been updated for over a year. Users are strongly advised to consider replacing the theme with a secure alternative (Patchstack).