Vulnerability in NewMash Theme Allows Authenticated Attackers to Inject Arbitrary Web Scripts

CVE-2024-10849

What is CVE-2024-10849?

The NewsMash theme for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability, owing to inadequate input sanitization and output escaping mechanisms. This vulnerability permits authenticated users, specifically those with Contributor-level access and higher, to inject potentially harmful web scripts into pages. Such scripts are then executed when a user visits the manipulated page, leading to possible compromise of user access or data. Users of the affected versions are encouraged to update to address this security issue.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References