CVE-2024-9366: 
WordPress vulnerability analysis and mitigation

The Easy Menu Manager | WPZest plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-9366) that affects all versions up to and including 1.0.1. The vulnerability was discovered and disclosed on October 17, 2024, and the plugin has been closed due to this security issue as of October 16, 2024 (NVD, WordPress Plugin).

The vulnerability stems from insufficient input sanitization and output escaping specifically related to SVG file uploads. The issue has been assigned a CVSS v3.1 base score of 6.4 (Medium) by Wordfence and 5.4 (Medium) by NIST, with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

When exploited, this vulnerability allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses the affected SVG file, potentially compromising the security of site visitors (NVD).

The plugin has been closed and is no longer available for download from the WordPress plugin repository as of October 16, 2024. Users are advised to immediately remove this plugin from their WordPress installations (WordPress Plugin).