Vulnerability in NewMash Theme Allows Authenticated Attackers to Inject Arbitrary Web Scripts

CVE-2024-10849

What is CVE-2024-10849?

The NewsMash theme for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability, owing to inadequate input sanitization and output escaping mechanisms. This vulnerability permits authenticated users, specifically those with Contributor-level access and higher, to inject potentially harmful web scripts into pages. Such scripts are then executed when a user visits the manipulated page, leading to possible compromise of user access or data. Users of the affected versions are encouraged to update to address this security issue.

References