CVE-2024-53711: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Jean-Marc BIANCA's Hotlink2Watermark WordPress plugin, which also allows for Stored XSS attacks. The vulnerability affects versions through 0.3.2 of the plugin. The issue was initially reported on October 20, 2024, and was publicly disclosed on November 22, 2024 (Patchstack).

The vulnerability has been assigned CVE-2024-53711 and received a CVSS v3.1 Base Score of 7.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) and requires no authentication to exploit, though it does require user interaction (NVD).

The vulnerability could allow malicious actors to force higher privileged users to execute unwanted actions under their current authentication. The impact is considered to have low severity but affects confidentiality, integrity, and availability of the system (Patchstack).

The vulnerability is classified as having low complexity (AC:L) and requires no privileges (PR:N) to exploit, though user interaction (UI:R) is necessary. The attack can be initiated from the network (AV:N) and has been categorized as having changed scope (S:C) (NVD).

Currently, there is no official fix available for this vulnerability. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).