CVE-2024-4753: 
WordPress vulnerability analysis and mitigation

The WP Secure Maintenance WordPress plugin (versions before 1.7) contains a security vulnerability identified as CVE-2024-4753. This vulnerability stems from improper sanitization and escaping of certain plugin settings, potentially enabling high-privilege users such as administrators to execute Stored Cross-Site Scripting (XSS) attacks, even in environments where the unfiltered_html capability is disabled, such as in multisite setups. The vulnerability was publicly disclosed on June 21, 2024 (WPScan).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue, specifically of the stored variety, and is tracked as CWE-79 (Improper Neutralization of Input During Web Page Generation). It has received a CVSS v3.1 base score of 4.8 (Medium) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, while CISA-ADP assessed it with a slightly higher score of 5.9 (Medium) (NVD).

When exploited, this vulnerability allows privileged users to store and execute malicious scripts through the plugin's settings, potentially affecting other users who access the affected pages. This is particularly concerning in multisite WordPress installations where the unfiltered_html capability is typically restricted for security purposes (WPScan).

The vulnerability can be exploited by accessing the WP Secure Settings and injecting malicious payload into the 'Label For Submit Button' field. A proof of concept demonstrates that adding a simple XSS payload such as "> to this field can trigger the vulnerability (WPScan).

The vulnerability has been patched in version 1.7 of the WP Secure Maintenance plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).