CVE-2024-51875: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability has been identified in the Nazmul Ahsan MDC YouTube Downloader WordPress plugin, tracked as CVE-2024-51875. The vulnerability affects versions through 3.0.0 and was discovered on October 29, 2024, with public disclosure occurring on November 8, 2024. The issue specifically involves DOM-Based XSS due to improper neutralization of input during web page generation (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium severity) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The security issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerability requires contributor-level privileges or higher to exploit (Patchstack).

The vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when visitors access the affected site (Patchstack).

Currently, there is no official fix available for this vulnerability. The issue remains unpatched in version 3.0.0 and earlier versions of the MDC YouTube Downloader plugin (Patchstack).