CVE-2024-4621: 
WordPress vulnerability analysis and mitigation

CVE-2024-4621 affects the ARForms - Premium WordPress Form Builder Plugin versions before 6.6. The vulnerability was discovered and disclosed on May 17, 2024. This security issue impacts WordPress installations using the affected plugin versions, particularly in multisite setups (WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS score of 3.5 (low). The security flaw exists because the plugin fails to properly sanitize and escape some of its settings, particularly in the Custom CSS functionality. This vulnerability is categorized under CWE-79 and falls into the OWASP Top 10 category A7: Cross-Site Scripting (WPScan).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, even in environments where the unfiltered_html capability is explicitly disallowed, such as in multisite WordPress setups (WPScan).

The vulnerability can be exploited by adding or editing an existing form and inserting malicious payload in the Custom CSS field. For example, entering a payload like p {color: red;} alert(2) will trigger the XSS upon saving and reloading the page (WPScan).

The vulnerability has been fixed in ARForms version 6.6. Users are advised to update to this version or later to mitigate the security risk (WPScan).