CVE-2024-4385: 
WordPress vulnerability analysis and mitigation

CVE-2024-4385 affects the Envo Extra plugin for WordPress in versions up to and including 1.8.16. The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue that affects multiple parameters in the plugin (NVD).

The vulnerability stems from insufficient input sanitization and output escaping in multiple parameters within the plugin. The issue has been assigned a CVSS v3.1 base score of 5.4 (Medium) by NVD with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Wordfence assigned a score of 6.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated user with at least contributor-level permissions to exploit. The attack complexity is considered low, requiring network access and user interaction for successful exploitation (NVD).

A patch has been released to address this vulnerability. Users are advised to update their Envo Extra plugin to a version newer than 1.8.16 (WordPress Plugin).