CVE-2024-5223: Stored Cross-Site Scripting (XSS) vulnerability in WordPress PostX Plugin. Authenticated attackers with author-level access can inject malicious scripts.

CVE-2024-5223 is a stored XSS vulnerability affecting the Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress versions up to 4.1.1. The vulnerability arises from insufficient sanitization of user-supplied input and inadequate output escaping during file uploads. Attackers with author-level permissions or higher can inject arbitrary web scripts into pages. When a user visits a compromised page, the injected scripts execute, potentially leading to account compromise, data theft, or malware distribution. While the CVSS score is 0, the SOCRadar Vulnerability Risk Score (SVRS) is 30 and it is tagged as "In The Wild," indicating some level of real-world exploitation, so patching is recommended despite the low CVSS. Website administrators using the PostX plugin should update to the latest version as soon as possible to mitigate this risk. This vulnerability allows malicious actors to perform actions on behalf of unsuspecting users.