CVE-2024-8959: 
WordPress vulnerability analysis and mitigation

The WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-8959) that affects all versions up to and including 4.0.1.6. The vulnerability was discovered and disclosed on October 23, 2024 (NVD, Wordfence).

The vulnerability is caused by insufficient input sanitization and output escaping in the SVG file upload functionality. This allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages that will execute whenever a user accesses the SVG file. The vulnerability has been assigned a CVSS v3.1 score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows attackers to inject malicious scripts that execute in users' browsers when viewing affected pages. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the victim's browser session (NVD).

The vulnerability requires an authenticated user with Author-level privileges or higher to exploit. The attack complexity is considered low as it only requires the ability to upload SVG files through the plugin's functionality (NVD).

Users should update to version 4.0.1.7 or later which contains security fixes for SVG upload files. The fix was released as part of the plugin's security updates (WP Adminify Changelog).