CVE-2024-9116: 
WordPress vulnerability analysis and mitigation

The Monkee-Boy Essentials plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 1.1. The vulnerability was discovered and disclosed on October 24, 2024, affecting the SVG file upload functionality (NVD).

The vulnerability stems from insufficient input sanitization and output escaping in the SVG file upload functionality. This security flaw has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, indicating a network-exploitable vulnerability with low attack complexity requiring low privileges (NVD).

When exploited, this vulnerability allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages through SVG file uploads. These malicious scripts will execute whenever a user accesses the affected SVG file, potentially compromising the security of site visitors (NVD).

As of October 24, 2024, the plugin has been closed and is no longer available for download from the WordPress plugin repository due to this security issue. Users are advised to remove the plugin from their WordPress installations (WordPress Plugin).