CVE-2024-8965: 
WordPress vulnerability analysis and mitigation

The Absolute Reviews plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-8965) in versions up to and including 1.1.3. The vulnerability was discovered and reported by Wordfence, with the initial disclosure on September 27, 2024 (NVD).

The vulnerability exists due to insufficient input sanitization and output escaping in the 'Name' field of a custom post criteria. The issue has been assigned a CVSS v3.1 base score of 5.4 (Medium) by NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, while Wordfence assigned a slightly higher score of 6.4 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

This vulnerability allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to compromised user sessions, data theft, or other malicious actions (NVD).

A patch has been released to address this vulnerability. Users should upgrade to a version newer than 1.1.3 of the Absolute Reviews plugin (WordPress Patch).