CVE-2024-5440: 
WordPress vulnerability analysis and mitigation

CVE-2024-5440 affects the If-So Dynamic Content Personalization WordPress plugin versions before 1.8.0.3. The vulnerability was discovered by Felipe Caon and was publicly disclosed on May 10, 2024. This security issue exists in the plugin's shortcode functionality, where certain attributes are not properly validated and escaped before being output in pages or posts (WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue, identified under CWE-79. It has been assigned a CVSS score of 6.8 (medium severity). The technical issue stems from the plugin's failure to validate and escape shortcode attributes before outputting them back in pages or posts where the shortcode is embedded (WPScan).

Users with contributor role and above can exploit this vulnerability to perform Stored Cross-Site Scripting attacks on affected WordPress installations. This could potentially allow attackers to inject malicious JavaScript code that executes in visitors' browsers (WPScan).

The vulnerability has been fixed in version 1.8.0.3 of the If-So Dynamic Content Personalization plugin. Users are strongly advised to update to this version or later to protect against this security issue (WPScan).