CVE-2024-4636: 
WordPress vulnerability analysis and mitigation

The Image Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-4636) in versions up to and including 3.12.10. The vulnerability exists in the 'allow_meme_types' function due to insufficient input sanitization and output escaping (NVD).

The vulnerability is rated as MEDIUM with a CVSS v3.1 base score of 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). The security flaw stems from improper input validation and output escaping in the 'allow_meme_types' function, which can be found in the admin.php file (WordPress Plugin).

When exploited, this vulnerability allows authenticated attackers with contributor-level permissions or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page (NVD).

The vulnerability requires an authenticated user with at least contributor-level permissions to exploit. The attack complexity is considered low, requiring network access but no user interaction for successful exploitation (Wordfence).

Users should update to a version newer than 3.12.10 of the Image Optimization by Optimole plugin to address this vulnerability. The fix has been implemented in subsequent versions as documented in the WordPress plugin repository (WordPress Changeset).