CVE-2024-7090 is a reflected cross-site scripting vulnerability in the LH Add Media From Url WordPress plugin (shawfactor) affecting all versions up to and including 1.23. The vulnerability arises from improper input sanitization and output escaping of the 'lh_add_media_from_url-file_url' parameter, enabling unauthenticated attackers to inject malicious scripts that execute in the context of a victim's browser upon user interaction. The CVSS 3.1 base score is 6.1 (medium), with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, no impact on availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of user data or session tokens. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction (clicking a crafted link) and does not require authentication.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, consider disabling or removing the LH Add Media From Url plugin if feasible, or applying web application firewall (WAF) rules to block malicious input patterns targeting the vulnerable parameter. Avoid clicking suspicious links related to this plugin.