CVE-2024-4290: 
WordPress vulnerability analysis and mitigation

The Sailthru Triggermail WordPress plugin through version 1.1 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered on April 30, 2024 and was assigned CVE-2024-4290 (WPScan).

The vulnerability exists because the plugin does not properly sanitize and escape some of its settings. This security issue affects high privilege users such as administrators, allowing them to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, such as in multisite setups. The vulnerability has been assigned a CVSS 3.1 score of 7.1 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (CISA-ADP).

When exploited, this vulnerability could allow attackers with administrative privileges to store and execute malicious JavaScript code on the affected WordPress site, potentially impacting other users who access the affected pages (WPScan).

The vulnerability can be exploited by accessing the plugin's settings page at /wp-admin/options-general.php?page=sailthru&action=options and entering XSS payloads into any of the input fields. A proof of concept demonstrates that entering a payload like ">alert(2) in any input field and saving will trigger the XSS (WPScan).

Currently, there is no known fix available for this vulnerability. Site administrators should consider either removing the plugin or implementing additional security controls to restrict access to the plugin's settings page (WPScan).