CVE-2024-3918: 
WordPress vulnerability analysis and mitigation

The Pet Manager WordPress plugin through version 1.4 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered on May 2, 2024, and was assigned CVE-2024-3918 (WPScan).

The vulnerability exists because the plugin does not properly sanitize and escape some of its Pet settings. This security issue has been assigned a CVSS score of 5.9 (medium), and is classified as CWE-79: Cross-Site Scripting. The vulnerability specifically affects high privilege users such as Contributors who can perform Stored Cross-Site Scripting attacks (WPScan).

If exploited, this vulnerability allows high privilege users such as Contributors to perform Stored Cross-Site Scripting attacks against the website. This could potentially lead to the execution of malicious JavaScript code in users' browsers (WPScan).

A proof of concept exists demonstrating the vulnerability: 1. Navigate to "Pets > Add Pet", 2. In the "Address" field add the payload " style=animation-name:rotation onanimationstart=alert(/XSS/)//, 3. Save and reload to see the XSS execution (WPScan).

Currently, there is no known fix available for this vulnerability. Users of the Pet Manager WordPress plugin version 1.4 or earlier should consider implementing additional security controls or evaluating alternative solutions (WPScan).