CVE-2024-6897: 
WordPress vulnerability analysis and mitigation

The aThemes Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via SVG File uploads in versions up to and including 1.0.53. This vulnerability was discovered and reported by Wordfence, with the initial disclosure made on July 27, 2024 (Wordfence Intel).

The vulnerability stems from insufficient input sanitization and output escaping in the plugin's file upload functionality. This security flaw is specifically related to SVG file uploads, where the plugin fails to properly validate and sanitize the uploaded content. The vulnerability has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised SVG file, potentially leading to unauthorized access to sensitive information or manipulation of website content (Wordfence Intel).

The vulnerability requires authentication with Author-level privileges or higher to exploit. No user interaction is needed for the execution of the injected scripts once they are uploaded to the site. The attack vector is network-accessible, and the complexity of exploitation is considered low (NVD).

Website administrators using the aThemes Starter Sites plugin should update to a version newer than 1.0.53 as soon as possible. The vulnerability has been patched in subsequent releases (WordPress Plugin).