CVE-2024-6094: 
WordPress vulnerability analysis and mitigation

The WP ULike WordPress plugin before version 4.7.1 contains a Stored Cross-Site Scripting (XSS) vulnerability. This security issue affects high-privilege users such as administrators, allowing them to perform Stored XSS attacks even when the unfiltered_html capability is disallowed, which is particularly concerning in multisite setups (WPScan, NVD).

The vulnerability stems from improper sanitization and escaping of certain plugin settings. The issue has been assigned CVE-2024-6094 and has a CVSS v3.1 base score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

When exploited, this vulnerability allows high-privilege users to inject malicious scripts into the plugin settings, which can then be executed when other users view affected pages. This is particularly concerning in multisite WordPress installations where the unfiltered_html capability is typically restricted (WPScan).

The vulnerability can be exploited by accessing the plugin settings page and manipulating the 'button image' field in the Content Type section. For example, injecting a payload like 'https://123.123"asdasd=''"' can trigger script execution when the button renders on a post (WPScan).

Users are advised to update to WP ULike version 4.7.1 or later, which contains the fix for this vulnerability (WPScan).