CVE-2024-50439: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Astra Widgets WordPress plugin, affecting versions up to and including 1.2.14. The vulnerability was identified on October 24, 2024, and was assigned CVE-2024-50439. The issue affects the Brainstorm Force Astra Widgets plugin and requires contributor-level access or higher to exploit (Patchstack, WPScan).

The vulnerability stems from insufficient input sanitization and output escaping in the Astra Widgets plugin. It has been assigned a CVSS v3.1 base score of 5.4 (Medium) by NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Patchstack assessed it with a slightly higher score of 6.5 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to data theft, session hijacking, or other malicious actions (WPScan).

The vulnerability has been patched in version 1.2.15 of the Astra Widgets plugin. Users are advised to update to this version or later to remediate the security issue (Patchstack).