CVE-2024-3903: 
WordPress vulnerability analysis and mitigation

The Add Custom CSS and JS WordPress plugin through version 1.20 contains a vulnerability that combines Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) issues. The plugin lacks proper CSRF checks in certain areas and is missing proper sanitization and escaping mechanisms (WPScan).

The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The issue stems from missing CSRF protection mechanisms combined with inadequate input sanitization and output escaping, which creates conditions for stored XSS attacks (NVD).

This vulnerability allows attackers to execute stored XSS payloads through CSRF attacks when targeting users with author-level privileges or higher. The successful exploitation could lead to unauthorized actions being performed in the context of the authenticated user (WPScan).

The vulnerability requires an attacker to craft a specific HTML payload and trick an authenticated user with author or higher privileges to open it. The attack vector has been verified and confirmed by security researchers (WPScan).

Currently, there is no known fix available for this vulnerability in the Add Custom CSS and JS WordPress plugin (WPScan).