CVE-2024-9353: 
WordPress vulnerability analysis and mitigation

The Popularis Extra plugin for WordPress contains a Reflected Cross-Site Scripting vulnerability (CVE-2024-9353) affecting all versions up to and including 1.2.6. The vulnerability was discovered and reported by Wordfence, with public disclosure on October 4, 2024. The issue stems from improper escaping of URL parameters in the addqueryarg & removequeryarg functions (NVD).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 base score of 6.1 (Medium). The attack vector is network-accessible (AV:N), requires low attack complexity (AC:L), needs no privileges (PR:N), requires user interaction (UI:R), and has a changed scope (S:C) with low confidentiality and integrity impacts (C:L, I:L) and no availability impact (A:N) (Wordfence).

If successfully exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when users perform specific actions, such as clicking on a malicious link. The impact primarily affects confidentiality and integrity with low severity (NVD).

Users should upgrade to version 1.2.7 or later of the Popularis Extra plugin to address this vulnerability (NVD).