CVE-2024-7090: 
WordPress vulnerability analysis and mitigation

The LH Add Media From Url plugin for WordPress contains a Reflected Cross-Site Scripting vulnerability (CVE-2024-7090) that affects all versions up to and including 1.23. The vulnerability exists in the 'lhaddmediafromurl-file_url' parameter due to insufficient input sanitization and output escaping (NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) with a CVSS v3.1 Base Score of 6.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The issue stems from improper handling of the 'lhaddmediafromurl-file_url' parameter, which lacks proper input validation and output escaping mechanisms (Wordfence).

This vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when users perform specific actions, such as clicking on a malicious link. The successful exploitation could lead to theft of sensitive information or manipulation of user interactions within the WordPress admin interface (NVD).

Users should update to a version newer than 1.23 if available, or consider removing the plugin if it's not essential to their WordPress installation. Website administrators should also implement general security best practices such as input validation and output encoding (NVD).