The Rent Fetch plugin for WordPress contains a Stored Cross-Site Scripting vulnerability that allows unauthenticated attackers to inject malicious scripts into the application.

This vulnerability occurs due to improper input sanitization and output escaping on the keyword parameter. Unauthenticated attackers can inject arbitrary web scripts that execute within the context of a victim's browser when they access the affected page.

Successful exploitation of this flaw can lead to unauthorized actions performed on behalf of authenticated users, potentially including administrative account takeover or the redirection of site traffic. Given the CVSS score of 7.2, this vulnerability represents a significant risk to the integrity and security of the WordPress installation. Failure to remediate may lead to unauthorized data access or the compromise of user sessions.

Immediate Action: Update the Rent Fetch plugin to version 0.32.5 or the latest available release to incorporate the necessary input validation patches.

Proactive Monitoring: Review web server access logs for anomalous requests containing script tags or encoded characters directed toward the plugin settings or keyword parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common XSS patterns in incoming HTTP requests until the plugin can be updated.

Public Exploit Available: Unknown

This vulnerability presents a high risk due to the lack of required authentication for exploitation and the potential for persistent malicious activity. Organizations utilizing the Rent Fetch plugin must prioritize updating to the patched version immediately to ensure the security of their WordPress environment and prevent potential cross-site scripting attacks.