CVE-2024-49635: 
WordPress vulnerability analysis and mitigation

A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Manzurul Haque Banner Slider WordPress plugin, affecting versions up to and including 2.1. The vulnerability was discovered on October 16, 2024, and publicly disclosed on October 21, 2024 (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and has received a CVSS v3.1 base score of 6.1 (MEDIUM) from NIST with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Patchstack has assigned a slightly higher CVSS score of 7.1 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (NVD).

The vulnerability allows attackers to inject malicious scripts, which could lead to redirects, unauthorized advertisements, and execution of other HTML payloads when visitors access the affected website. The impact is particularly concerning as it requires no authentication to exploit (Patchstack).

Currently, no official fix is available for this vulnerability. However, Patchstack has issued a virtual patch to mitigate the issue by blocking potential attacks until an official fix becomes available. Website owners are advised to implement the virtual patch immediately (Patchstack).