CVE-2024-4005: 
WordPress vulnerability analysis and mitigation

The Social Pixel WordPress plugin through version 2.1 contains a stored Cross-Site Scripting (XSS) vulnerability that affects high-privilege users such as administrators. This vulnerability was discovered in 2024 and assigned identifier CVE-2024-4005. The issue affects the plugin's settings functionality, particularly when the unfiltered_html capability is disallowed, such as in multisite setups (WPScan).

The vulnerability stems from insufficient sanitization and escaping of certain plugin settings. It has been assigned a CVSS v3.1 base score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) (NVD).

When exploited, this vulnerability allows administrators to perform Stored Cross-Site Scripting attacks even in environments where the unfiltered_html capability is disabled. This is particularly relevant in multisite WordPress installations where such restrictions are commonly implemented (WPScan).

The vulnerability can be exploited by accessing the plugin's settings page at /wp-admin/options-general.php?page=social-pixel and injecting malicious payload in the Facebook 'Identificador' field. The attack requires high privileges (administrator access) and user interaction for successful exploitation (WPScan).