CVE-2024-4623: 
WordPress vulnerability analysis and mitigation

The Blogmentor – Blog Layouts for Elementor WordPress plugin contains a Stored Cross-Site Scripting vulnerability (CVE-2024-4623) affecting versions up to and including 1.5. The vulnerability was discovered and disclosed on June 19, 2024. The issue exists in the 'pagination_style' parameter due to insufficient input sanitization and output escaping (NVD).

The vulnerability is rated with a CVSS v3.1 Base Score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The security flaw allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the affected page (Wordfence).

When successfully exploited, this vulnerability allows attackers to inject and execute malicious JavaScript code in the context of other users' browsers who visit the affected pages. This could lead to theft of sensitive information, session hijacking, or other client-side attacks against site visitors (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, as it does not require special conditions or circumstances to be successful (NVD).

Website administrators running the affected versions of the Blogmentor plugin should update to a version newer than 1.5 as soon as possible to address this security issue (NVD).