CVE-2024-4335: 
WordPress vulnerability analysis and mitigation

The Rank Math SEO with AI Best SEO Tools plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-4335) affecting versions up to and including 1.0.217. The vulnerability exists due to insufficient input sanitization and output escaping of the 'textAlign' parameter (NVD).

The vulnerability stems from improper sanitization and escaping of the 'textAlign' parameter in the plugin. This security flaw allows authenticated users with contributor-level permissions or higher to inject arbitrary web scripts into pages. These injected scripts will execute whenever a user accesses the affected page. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (Wordfence).

The vulnerability allows authenticated attackers with contributor-level permissions or higher to inject malicious scripts into pages. When other users access these compromised pages, the injected scripts will automatically execute in their browsers, potentially leading to unauthorized actions, data theft, or other malicious activities (NVD).

The vulnerability requires an authenticated user with at least contributor-level permissions to exploit. The attack vector is network-accessible (N) with low attack complexity (L) and requires low privileges (L). No user interaction is needed for the exploit to be successful (Wordfence).

Users should update their Rank Math SEO plugin to a version newer than 1.0.217 to address this vulnerability. The fix has been implemented in subsequent versions to properly sanitize and escape the 'textAlign' parameter (NVD).