CVE-2024-7918: 
WordPress vulnerability analysis and mitigation

The Pocket Widget WordPress plugin through version 0.1.3 contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered by Bob Matyas and was publicly disclosed on August 19, 2024. This security issue affects the plugin's settings functionality, specifically impacting WordPress installations including multisite setups (WPScan).

The vulnerability stems from improper sanitization and escaping of certain plugin settings. It has been assigned CVE-2024-7918 and received a CVSS v3.1 base score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

When exploited, this vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, even in environments where the unfiltered_html capability is explicitly disallowed. This is particularly relevant in multisite WordPress installations (WPScan).

Currently, there is no known fix available for this vulnerability. Users should consider implementing additional security controls or temporarily disabling the plugin until a patch is released (WPScan).