CVE-2024-51819: 
WordPress vulnerability analysis and mitigation

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Tigris Flexplatform WordPress plugin, affecting versions up to and including 1.0.2. The vulnerability was identified by security researcher Joshua Chan on October 28, 2024, and was publicly disclosed on November 8, 2024. The issue was assigned CVE-2024-51819 (Patchstack, WPScan).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It received a CVSS v3.1 score of 6.5 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The vulnerability requires contributor-level access or higher to exploit, and it stems from insufficient input sanitization and output escaping in the plugin (Patchstack).

The vulnerability allows authenticated attackers with contributor-level privileges to inject malicious scripts into pages. These scripts, which could include redirects, advertisements, and other HTML payloads, will execute whenever a user accesses an affected page. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (WPScan, Patchstack).

Currently, there is no official fix available for this vulnerability. The issue affects versions up to and including 1.0.2 of the Tigris Flexplatform plugin (Patchstack).