CVE-2024-3823: 
WordPress vulnerability analysis and mitigation

The Base64 Encoder/Decoder WordPress plugin through version 0.9.2 contains a security vulnerability identified as CVE-2024-3823. The vulnerability was discovered and publicly disclosed on April 24, 2024. This security issue affects the plugin's settings functionality and impacts WordPress installations using the Base64 Encoder/Decoder plugin versions 0.9.2 and below (WPScan).

The vulnerability stems from the absence of CSRF (Cross-Site Request Forgery) protection in the plugin's settings update functionality, combined with inadequate input sanitization and output escaping. These security oversights create a pathway for potential Stored Cross-Site Scripting (XSS) attacks through CSRF (WPScan).

The vulnerability allows attackers to execute a CSRF attack that could lead to stored XSS payloads being added to the site through the plugin's settings. This affects WordPress installations where an administrator is logged in, potentially compromising the security of the WordPress site (WPScan).

The vulnerability can be exploited by tricking a logged-in administrator into opening a specially crafted HTML file containing malicious code. The attack requires no special privileges beyond the ability to make the administrator visit a malicious page (WPScan).

Currently, there is no known fix available for this vulnerability. Users of the Base64 Encoder/Decoder plugin should consider either removing the plugin or implementing additional security measures to protect against CSRF attacks (WPScan).