CVE-2024-5259: 
WordPress vulnerability analysis and mitigation

The MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution plugin for WordPress contains a Stored Cross-Site Scripting vulnerability in versions up to and including 4.1.11. The vulnerability exists in the 'hover_animation' parameter due to insufficient input sanitization and output escaping. This security issue was discovered and reported by Wordfence, and was fixed in version 4.1.12 (Wordfence Advisory).

The vulnerability is classified as a Stored Cross-Site Scripting (CWE-79) issue that affects the 'hover_animation' parameter in the plugin. The security flaw stems from inadequate input sanitization and output escaping mechanisms, allowing malicious scripts to be stored and executed. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to unauthorized access to sensitive information or manipulation of website content (NVD).

The vulnerability requires an authenticated user with at least Contributor-level privileges to exploit. The attack complexity is considered low, requiring user interaction for successful exploitation (NVD).

Website administrators using the affected plugin versions should immediately upgrade to version 4.1.12 or later, which contains the security fix for this vulnerability. The update is available through the WordPress plugin repository (WordPress Plugin).