CVE-2024-8325: 
WordPress vulnerability analysis and mitigation

The Blockspare WordPress plugin (versions up to and including 3.2.4) contains a Stored Cross-Site Scripting vulnerability in the 'blockspare_render_social_sharing_block' function. This vulnerability was assigned CVE-2024-8325 and affects the plugin's social sharing block functionality (NVD).

The vulnerability exists due to insufficient input sanitization and output escaping in the 'blockspare_render_social_sharing_block' function. The CVSS v3.1 base score is 5.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N according to NVD, while Wordfence assessed it at 6.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the compromised page (NVD).

The vulnerability requires authentication with at least Contributor-level access to exploit. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L) (NVD).

A patch has been released to address this vulnerability. Users should upgrade to a version newer than 3.2.4 to mitigate this security issue (WordPress Plugin).