CVE-2024-4417: 
WordPress vulnerability analysis and mitigation

The Falang multilanguage for WordPress plugin is affected by a Stored Cross-Site Scripting vulnerability (CVE-2024-4417) in versions up to and including 1.3.49. The vulnerability stems from insufficient input sanitization and output escaping in the admin settings (NVD).

The vulnerability exists due to insufficient input sanitization and output escaping in the admin settings. The CVSS v3.1 base score is 4.4 (Medium) with the following vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires network access, has high attack complexity, requires high privileges, needs no user interaction, has changed scope, and can impact both confidentiality and integrity at a low level, with no impact on availability (NVD).

When exploited, this vulnerability allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts into pages. These injected scripts will execute whenever a user accesses the affected page. The vulnerability specifically affects multi-site installations and installations where unfiltered_html has been disabled (NVD).

The vulnerability requires an authenticated attacker with administrator-level permissions to exploit. The attack complexity is considered high, and the attacker needs network access to the target system (NVD).