CVE-2024-7955

CVE-2024-7955 describes a Stored Cross-Site Scripting (XSS) vulnerability in the Starbox WordPress plugin prior to version 3.5.2. This medium-severity flaw (CVSS 4.8) allows high-privilege users, such as administrators, to inject malicious scripts due to insufficient sanitization of plugin settings, even in environments where unfiltered_html is restricted. While exploitation requires high privileges and user interaction, successful attacks could lead to client-side compromise. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.