CVE-2024-43303: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the White Label CMS WordPress plugin, affecting versions up to and including 2.7.4. The vulnerability was reported on July 25, 2024, by security researcher Rafie Muhammad and was officially published on August 16, 2024. This security issue was assigned CVE-2024-43303 (Patchstack, WPScan).

The vulnerability stems from insufficient input sanitization and output escaping in the White Label CMS plugin. It has been classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and received a CVSS v3.1 score of 7.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability falls under the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (Patchstack, WPScan).

The vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute when users perform specific actions, such as clicking on a malicious link. This could enable attackers to inject malicious scripts, including redirects, advertisements, and other HTML payloads that would be executed when guests visit the affected site (Patchstack).

The vulnerability is considered moderately dangerous and is expected to become exploited. It requires no authentication to exploit, though user interaction is necessary for successful exploitation. The attack vector is network-accessible, with low attack complexity (Patchstack).

The vulnerability has been fixed in version 2.7.5 of the White Label CMS plugin. Users are advised to update to version 2.7.5 or later immediately. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users can update to the fixed version (Patchstack).