CVE-2024-9269: 
WordPress vulnerability analysis and mitigation

The Relogo plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-9269) that affects all versions up to and including 0.4.2. The vulnerability was discovered and disclosed on September 30, 2024, and the plugin was subsequently closed on the same date due to security concerns (NVD, WordPress).

The vulnerability stems from insufficient input sanitization and output escaping in the plugin's SVG file upload functionality. It has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD, Wordfence).

When exploited, this vulnerability allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the affected SVG file, potentially compromising the security of site visitors (NVD).

The WordPress repository has closed the plugin as of September 30, 2024, due to this security issue. Users are advised to immediately remove the Relogo plugin from their WordPress installations as no patch is available (WordPress).