CVE-2024-5811: 
WordPress vulnerability analysis and mitigation

The Simple Video Directory WordPress plugin versions prior to 1.4.4 contain a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and publicly disclosed on June 21, 2024, and was assigned the identifier CVE-2024-5811. The issue affects the plugin's settings functionality, specifically impacting WordPress installations including multisite setups (WPScan, CVE).

The vulnerability stems from improper sanitization and escaping of certain settings within the plugin. The issue has been assigned a CVSS score of 6.8 (medium severity) and is classified under CWE-79. The vulnerability specifically affects the 'Media Title' and 'Media Subtitle' fields in the plugin's functionality (WPScan).

This vulnerability allows contributors and users with higher privileges to perform Stored Cross-Site Scripting attacks, even in environments where the unfiltered_html capability is disabled. This is particularly significant in multisite WordPress setups (CVE).

The vulnerability can be exploited by adding malicious payloads to either the 'Media Title' or 'Media Subtitle' fields when creating new content at 'wp-admin/post-new.php?post_type=smd'. The XSS payload becomes active when an administrator adds the shortcode for the affected media (WPScan).

The vulnerability has been fixed in version 1.4.4 of the Simple Video Directory plugin. Users are advised to update to this latest version to mitigate the security risk (WPScan).