CVE-2024-3023

The AnnounceKit plugin for WordPress, in all versions up to and including 2.0.9, is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping within admin settings. This vulnerability stems from improper handling of user-supplied data, allowing malicious scripts to be stored and later executed in the context of other users' browsers [1].

Exploitation requires an authenticated attacker with administrator-level permissions or above. The attack is only viable on multi-site installations or when the unfiltered_html capability has been disabled. Under these conditions, the attacker can inject arbitrary web scripts through plugin settings, which will execute whenever any user views the compromised page [1].

The impact includes persistent script execution, enabling privilege escalation, data theft, or further compromise of the WordPress site. As a stored XSS, the malicious payload remains until removed, affecting all visitors of the affected pages [1].

The AnnounceKit plugin has been closed as of April 19, 2024, due to this security issue and is no longer available for download. Users who have installed the plugin should remove it immediately, as no patch is forthcoming [1].