CVE-2024-5151: 
WordPress vulnerability analysis and mitigation

The SULly WordPress plugin before version 4.3.1 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered on July 13, 2024, and was assigned CVE-2024-5151. The issue affects the plugin's settings functionality, specifically impacting WordPress installations where the plugin is active (NVD).

The vulnerability stems from insufficient sanitization and escaping of some settings within the plugin. This security flaw could be exploited by users with high privileges, such as administrators, to perform Stored Cross-Site Scripting attacks, even in environments where the unfiltered_html capability is disabled, such as in multisite setups. The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (NVD).

When exploited, this vulnerability allows high-privilege users to store and execute malicious JavaScript code in the plugin's settings. The stored XSS payload would execute whenever a user accesses the affected page, potentially leading to unauthorized actions being performed in the context of the victim's browser session (WPScan).

The vulnerability can be exploited by accessing the Dashboard >> SULly section and setting a malicious payload as an Item. The attack requires high privileges (admin access) to execute, making it somewhat limited in scope but still significant in multisite WordPress installations (WPScan).

The vulnerability has been patched in SULly version 4.3.1. Users are strongly advised to update to this version or later to mitigate the risk (WPScan).