CVE-2024-7879: 
WordPress vulnerability analysis and mitigation

The WP ULike WordPress plugin before version 4.7.5 contains a Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered on October 16, 2024, and affects the plugin's widget settings functionality. This security issue exists because the plugin fails to properly sanitize and escape some of its settings (WPScan).

The vulnerability allows high privilege users such as editors to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. The issue specifically affects the widget title functionality. The CVSS v3.1 score is 4.8 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability could allow attackers with editor privileges to inject malicious JavaScript code through the widget title, which would execute when users access the WordPress admin widgets page (/wp-admin/widgets.php) and expand the WP Like widget (WPScan).

A proof of concept exists demonstrating the vulnerability can be exploited by adding the WP ULike widget and inserting a malicious payload in the widget title using the following code: " style=animation-name:rotation onanimationstart=alert(/XSS/)//. The XSS triggers when the widget is saved and when any user accesses the Widget page (WPScan).

The vulnerability has been fixed in WP ULike version 4.7.5. Users are advised to update to this version or later to mitigate the security risk (WPScan).