Stored Cross-Site Scripting Vulnerability in DirectoryPress Plugin for WordPress

CVE-2024-10584

Summary

The DirectoryPress – Business Directory and Classified Ad Listing plugin for WordPress is susceptible to a serious stored cross-site scripting issue due to inadequate input sanitization and output escaping when handling SVG file uploads. This vulnerability affects all versions of the plugin up to and including 3.6.16. Authenticated attackers with author-level access or higher can exploit this flaw to inject malicious web scripts into pages that execute when other users interact with the SVG files. Additionally, if DirectoryPress Frontend is utilized, unauthenticated users can also exploit this vulnerability, potentially compromising the security of the affected WordPress sites.

References