Stored XSS Vulnerability Affects Counter Up Plugin

CVE-2024-10895

What is CVE-2024-10895?

The Counter Up – Animated Number Counter & Milestone Showcase plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability, stemming from inadequate input sanitization and output escaping when using the 'lgx-counter' shortcode. This flaw allows authenticated users with contributor-level access or higher to inject arbitrary web scripts into pages. These injected scripts execute whenever other users access the compromised pages, posing a significant security risk for WordPress sites utilizing this plugin.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References