CVE-2024-39626: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in 5 Star Plugins Pretty Simple Popup Builder WordPress plugin, affecting versions up to 1.0.9. The vulnerability was identified on June 23, 2024, by researcher Anugrah Gilang Ramadhan and publicly disclosed on July 22, 2024 (Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It received a CVSS v3.1 base score of 4.8 (Medium) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, while Patchstack assigned it a score of 5.9 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability allows authenticated attackers with administrator-level access to inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page. This particularly impacts multi-site installations and installations where unfiltered_html has been disabled (WPScan).

The vulnerability requires high privileges (administrator-level access) and user interaction to be exploited. It is classified as having low attack complexity with network vector access (NVD).

The vulnerability has been patched in version 1.0.10 of the Pretty Simple Popup Builder plugin. Users are advised to update to this version or later to remove the vulnerability (Patchstack).