CVE-2024-6165: 
WordPress vulnerability analysis and mitigation

The WANotifier WordPress plugin before version 2.6.1 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered on July 10, 2024, and was assigned CVE-2024-6165. The issue affects the plugin's settings functionality, specifically impacting WordPress installations, including multisite setups (WPScan).

The vulnerability stems from improper sanitization and escaping of certain plugin settings. This security flaw allows high-privilege users, such as administrators, to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. The vulnerability has been assigned a CVSS v3.1 base score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows authenticated users with high privileges to inject and store malicious JavaScript code in the plugin settings. When other users access the affected pages, the stored malicious code executes in their browsers, potentially leading to session hijacking, credential theft, or other client-side attacks (WPScan).

A proof of concept exists demonstrating the vulnerability exploitation. An attacker can inject a malicious payload through the API key field in the WANotifier settings page. The exploit is triggered when the page reloads or when any user views the affected page. The specific payload example uses animation events to execute arbitrary JavaScript code (WPScan).

The vulnerability has been patched in WANotifier version 2.6.1. Users are strongly advised to update to this version or later to mitigate the security risk (WPScan).