CVE-2024-5177: 
WordPress vulnerability analysis and mitigation

The Hash Elements plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-5177) affecting all versions up to and including 1.3.8. The vulnerability exists in the 'url' parameter within multiple widgets due to insufficient input sanitization and output escaping on user-supplied attributes (NVD CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires low attack complexity, requires low privileges to exploit, and can potentially impact both confidentiality and integrity with no impact on availability (Wordfence Intel).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized data access or manipulation (NVD CVE).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attack can be executed remotely through the network with low attack complexity (Wordfence Intel).

Users should update their Hash Elements plugin to a version newer than 1.3.8 which contains the security fix. The fix can be observed in the WordPress plugin repository changelog (WordPress Plugin).