CVE-2024-5039: 
WordPress vulnerability analysis and mitigation

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress (CVE-2024-5039) contains a Stored Cross-Site Scripting vulnerability affecting all versions up to and including 1.3.5.3. The vulnerability was disclosed on May 29, 2024, and impacts the plugin's shortcode functionality (Wordfence).

The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcode implementation. The issue has been assigned a CVSS v3.1 Base Score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

When successfully exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack complexity is considered low, requiring no user interaction for successful exploitation (Wordfence).

Users should update to a patched version of the plugin when available. The vulnerability has been identified in the plugin's source code at woof.php (WordPress Plugin).