CVE-2024-49634: 
WordPress vulnerability analysis and mitigation

The BP Member Type Manager WordPress plugin contains a Reflected Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-49634. This security flaw affects versions up to and including 1.01 of the plugin, discovered and reported by João Pedro Soares de Alcântara on October 16, 2024. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's functionality (Patchstack, WPScan).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received varying CVSS scores from different sources. The National Vulnerability Database (NVD) assigned a CVSS v3.1 base score of 6.1 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, while Patchstack rated it at 7.1 (High) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability allows unauthenticated attackers to inject arbitrary web scripts into pages that will execute when users perform specific actions, such as clicking on a malicious link. This could enable attackers to inject malicious scripts, redirects, advertisements, and other HTML payloads that execute when visitors access the affected website (Patchstack).

Currently, there is no official fix available for this vulnerability. However, Patchstack has issued a virtual patch to mitigate the issue by blocking potential attacks until an official fix becomes available. Website administrators are advised to implement the mitigation immediately (Patchstack).