CVE-2024-6710: 
WordPress vulnerability analysis and mitigation

The Ditty WordPress plugin before version 3.1.45 contains a Cross-Site Scripting (XSS) vulnerability that affects users with roles as low as Contributor. The vulnerability was discovered on July 15, 2024, and was assigned CVE-2024-6710 (WPScan).

The vulnerability stems from improper sanitization and escaping of certain parameters in the plugin. The issue can be exploited by creating a new Ditty and adding a "Tiny MCE" block, then manipulating the main text field with malicious JavaScript code. The vulnerability has been assigned a CVSS v3.1 score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows authenticated users with Contributor-level access or higher to perform Cross-Site Scripting attacks against other users of the WordPress site (WPScan).

A proof of concept exists demonstrating that the vulnerability can be exploited by inserting malicious code such as <img src=x onerror=alert(1)> into the Tiny MCE block's main text field (WPScan).

The vulnerability has been patched in version 3.1.45 of the Ditty plugin. Site administrators are advised to update to this version or later to mitigate the risk (NVD).