Stored Cross-Site Scripting Vulnerability in YARPP Plugin for WordPress

CVE-2024-0602

What is CVE-2024-0602?

The YARPP - Yet Another Related Posts Plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in the admin settings. This vulnerability can be exploited by authenticated attackers with administrator-level permissions on multi-site installations and those with unfiltered_html disabled, enabling them to insert malicious web scripts that execute when users access affected pages.

References