CVE-2024-2967

The WP Front User Submit plugin (versions up to and including 4.4.7) contains a Stored Cross-Site Scripting (XSS) vulnerability in its form settings. The root cause is insufficient input sanitization and output escaping, allowing malicious script injection into pages [1].

Exploitation requires authenticated access with administrator-level permissions or higher. The vulnerability is only exploitable on multi-site installations or on single-site installations where the unfiltered_html capability has been disabled [1].

An attacker can inject arbitrary web scripts that execute whenever a user accesses the affected page. This can lead to session hijacking, defacement, or redirection to malicious sites, compromising the integrity of the WordPress instance [1].

Mitigation involves updating the plugin to a version newer than 4.4.7. Users should monitor the plugin's update page for the patched release. As a workaround, restrict admin-level access to trusted users only [1].