CVE-2024-49241: 
WordPress vulnerability analysis and mitigation

A DOM-Based Cross-Site Scripting (XSS) vulnerability was discovered in Tady Walsh Tito WordPress plugin affecting versions up to and including 2.3. The vulnerability was reported on October 4, 2024, and publicly disclosed on October 14, 2024 (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 5.4 (Medium) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Patchstack assigned a slightly higher CVSS score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website, which would be executed when guests visit the site. The attack requires user interaction and authenticated access with Contributor-level privileges or higher (Patchstack).

The vulnerability has been assessed as having a low severity impact and is considered unlikely to be exploited. It requires authenticated access with at least Contributor-level privileges to exploit (Patchstack).

As of the disclosure date, no official fix is available for this vulnerability. The issue affects versions up to and including 2.3 of the Tito WordPress plugin (Patchstack).