CVE-2024-4422: 
WordPress vulnerability analysis and mitigation

The Comparison Slider plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-4422) affecting all versions up to and including 1.0.5. The vulnerability was discovered in May 2024 and disclosed by May 30, 2024. The plugin has been closed since May 17, 2024 due to this security issue (NVD, WordPress).

The vulnerability stems from insufficient input sanitization and output escaping in the slider title parameter. This allows authenticated users with subscriber-level access or higher to inject arbitrary web scripts into pages. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) by NIST and 6.4 (Medium) by Wordfence, with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

When exploited, the vulnerability allows attackers to inject malicious web scripts that execute whenever a user accesses an affected page. This can lead to potential client-side attacks against site visitors and administrators (NVD).

The vulnerability requires authentication with at least subscriber-level access to exploit. The attack complexity is considered low, requiring only the ability to manipulate the slider title parameter (NVD).

The plugin has been closed and is no longer available for download from the WordPress plugin repository as of May 17, 2024. Users should immediately remove the plugin from their WordPress installations to mitigate the security risk (WordPress).