CVE-2024-50458: 
WordPress vulnerability analysis and mitigation

The CVE-2024-50458 is a Cross-site Scripting (XSS) vulnerability discovered in WP Codeus Advanced Sermons WordPress plugin affecting versions through 3.4. The vulnerability was reported by SOPROBRO on September 16, 2024, and was publicly disclosed on October 24, 2024 (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) with a CVSS v3.1 base score of 5.4 (MEDIUM) according to NIST, and 6.5 (MEDIUM) according to Patchstack. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating that the vulnerability requires network access, low attack complexity, low privileges, and user interaction (NVD).

This vulnerability allows malicious actors to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website which will be executed when guests visit the site. The stored XSS nature of the vulnerability means that the malicious payload persists in the website's database (Patchstack).

The vulnerability has been patched in version 3.5 of the Advanced Sermons plugin. Users are advised to update to version 3.5 or later to remove the vulnerability. Patchstack users can enable auto-update for vulnerable plugins (Patchstack).