CVE-2024-4095: 
WordPress vulnerability analysis and mitigation

The Collapse-O-Matic WordPress plugin (versions up to 1.8.5.7) contains a Stored Cross-Site Scripting vulnerability via the plugin's 'expand' and 'expandsub' shortcode attributes. The vulnerability was discovered and disclosed on June 14, 2024, and assigned CVE-2024-4095. The issue affects all versions of the plugin up to and including version 1.8.5.7 (NVD).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the 'expand' and 'expandsub' shortcodes. This security flaw has been assigned a CVSS v3.1 score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (Wordfence).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to unauthorized actions and data theft (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attacker must have the ability to create or edit posts/pages to inject malicious scripts through the plugin's shortcode attributes (NVD).

As of June 14, 2024, the plugin has been closed and is no longer available for download from the WordPress plugin repository due to this security issue. Users are advised to remove the plugin from their WordPress installations until a security fix is available (WordPress Plugin).