CVE-2024-52491: 
WordPress vulnerability analysis and mitigation

The Sticky Social Icons WordPress plugin, versions up to and including 1.2.1, contains a Stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and reported by UKO on October 24, 2024, and was publicly disclosed on November 20, 2024. This security issue has been assigned CVE-2024-52491 and affects installations where unfiltered_html has been disabled, particularly impacting multi-site installations (WPScan, Patchstack).

The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation (CWE-79) issue. It has received a CVSS v3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's functionality (Patchstack).

The vulnerability allows authenticated attackers with administrator-level access and above to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page. This could potentially lead to the injection of malicious content such as redirects, advertisements, and other HTML payloads that would be executed when guests visit the site (WPScan, Patchstack).

Currently, there is no official fix available for this vulnerability. The issue affects versions up to and including 1.2.1 of the Sticky Social Icons plugin (Patchstack).