CVE-2024-5172: 
WordPress vulnerability analysis and mitigation

CVE-2024-5172 affects the Expert Invoice WordPress plugin through version 1.0.2. The vulnerability stems from improper sanitization and escaping of settings, which could enable high-privilege users such as administrators to perform Stored Cross-Site Scripting (XSS) attacks, even when the unfiltered_html capability is disallowed, such as in multisite setups (WPScan, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The issue is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability specifically affects the customer management functionality where unsanitized input can be stored and executed (WPScan).

When exploited, this vulnerability allows high-privilege users to store and execute malicious JavaScript code, potentially affecting other users who access the affected pages. This is particularly concerning in multisite WordPress installations where the unfiltered_html capability is typically restricted (WPScan).

Currently, there is no known fix available for this vulnerability. Users should consider implementing additional security measures or temporarily disabling the plugin until a security update is released (WPScan).