CVE-2024-38697: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability has been identified in Ali Rahimi Goftino plugin through version 1.6. The vulnerability was discovered on July 11, 2024, and was assigned CVE-2024-38697. The issue affects WordPress installations using the Goftino plugin versions up to and including 1.6 (Patchstack).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS v3.1 base score of 6.5 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires subscriber-level privileges or higher to exploit (Patchstack).

If exploited, this vulnerability could allow an attacker to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected site (Patchstack).

Users are advised to update to Goftino plugin version 1.7 or later, which contains the fix for this vulnerability. For users of Patchstack, a virtual patch has been issued to mitigate this issue by blocking potential attacks until the update can be applied (Patchstack).