CVE-2024-5200: 
WordPress vulnerability analysis and mitigation

The Postie WordPress plugin versions prior to 1.9.71 contain a Stored Cross-Site Scripting (XSS) vulnerability. The plugin fails to properly sanitize and escape certain settings, which affects high-privilege users such as administrators, particularly in multisite setups where the unfiltered_html capability is disabled (WPScan).

The vulnerability exists in the Image settings section of the Postie plugin where custom templates can be configured. The lack of proper input sanitization and output escaping in these settings allows for the injection and storage of malicious JavaScript code. This stored XSS vulnerability can be triggered whenever someone accesses the affected settings page (WPScan). The vulnerability has been assigned a CVSS score of 3.5 (Low) and is classified under CWE-79.

The vulnerability allows high-privilege users such as administrators to store and execute malicious JavaScript code through the plugin's settings. When triggered, this could potentially lead to client-side attacks against other administrative users accessing the settings page (WPScan).

The vulnerability has been fixed in Postie version 1.9.71. Users are strongly advised to update to this version or later to address the security issue (WPScan).