CVE-2024-3580

CVE-2024-3580 describes a Stored Cross-Site Scripting (XSS) vulnerability in the Popup4Phone WordPress plugin, affecting versions up to and including 1.3.2. This flaw allows high-privilege users, such as Editors, to inject malicious scripts due to insufficient sanitization and escaping of plugin settings, even in environments where unfiltered_html is restricted. The vulnerability carries a CVSS score of 6.1 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and potentially leading to low impact on confidentiality and integrity. While the attack vector is network-based, it relies on a privileged user account. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public awareness and attention.