CVE-2024-4942: 
WordPress vulnerability analysis and mitigation

The Custom Dash plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-4942) affecting all versions up to and including 1.0.2. The vulnerability was disclosed on June 5, 2024, and due to the security concerns, the plugin has been closed and removed from the WordPress plugin directory as of June 4, 2024 (NVD, WordPress Plugin).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue that can be exploited through admin settings. The CVSS v3.1 score for this vulnerability indicates Network attack vector (AV:N), High attack complexity (AC:H), High privileges required (PR:H), No user interaction needed (UI:N), Changed scope (S:C), with Low confidentiality and integrity impact (C:L, I:L), and No availability impact (A:N) (Wordfence).

The vulnerability could allow attackers with administrative access to store and execute malicious scripts through the plugin's admin settings, potentially affecting the security of the WordPress installation (NVD).

The vulnerability requires high privileges (administrator level or above) to exploit, suggesting that while the vulnerability exists, the attack surface is limited to users who already have significant access to the WordPress installation (Wordfence).

As the plugin has been closed and removed from the WordPress plugin directory due to this security issue, the recommended mitigation is to completely remove the Custom Dash plugin from WordPress installations (WordPress Plugin).