CVE-2024-43161: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Slider & Popup Builder by Depicter WordPress plugin, affecting versions up to and including 3.1.2. The vulnerability was identified on August 7, 2024, and tracked as CVE-2024-43161. This security issue specifically impacts multi-site installations and installations where unfiltered_html has been disabled (WPScan).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It received a CVSS 3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's settings (Patchstack).

The vulnerability allows authenticated attackers with editor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page. The impact includes potential injection of malicious scripts, redirects, advertisements, and other HTML payloads that could compromise website security (WPScan, Patchstack).

The vulnerability requires an authenticated user with editor-level permissions or higher to exploit. It specifically affects multi-site installations and installations where unfiltered_html has been disabled, which somewhat limits its scope (WPScan).

The vulnerability has been patched in version 3.2.0 of the Depicter Slider plugin. Users are advised to update to version 3.2.0 or later to remove the vulnerability. The security issue is considered to have a low severity impact and is unlikely to be exploited (Patchstack).