CVE-2024-5003: 
WordPress vulnerability analysis and mitigation

The WP Stacker WordPress plugin through version 1.8.5 contains a security vulnerability that combines Cross-Site Request Forgery (CSRF) with Stored Cross-Site Scripting (XSS) issues. The vulnerability was publicly disclosed on May 17, 2024, and affects the plugin's input handling mechanisms (WPScan).

The vulnerability stems from the absence of proper CSRF protection mechanisms combined with inadequate input sanitization and output escaping. This security flaw has been assigned a CVSS score of 7.1 (High), indicating its significant severity. The vulnerability is classified under CWE-79, which pertains to Cross-Site Scripting issues (WPScan).

When successfully exploited, this vulnerability allows attackers to execute a CSRF attack that results in stored XSS payloads being added to the target system through a logged-in administrator's account. This creates a persistent security risk as the malicious code remains stored in the database (WPScan).

The vulnerability requires an attacker to craft a specific HTML document and trick an authenticated administrator into opening it. Once triggered, the attack can successfully store XSS payloads in the system through the administrator's privileges (WPScan).

Currently, there is no known fix available for this vulnerability in the WP Stacker plugin. Website administrators running affected versions (1.8.5 and below) should consider disabling the plugin until a security patch is released (WPScan).