Stored XSS Vulnerability Affects Counter Up Plugin

CVE-2024-10895

What is CVE-2024-10895?

The Counter Up – Animated Number Counter & Milestone Showcase plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability, stemming from inadequate input sanitization and output escaping when using the 'lgx-counter' shortcode. This flaw allows authenticated users with contributor-level access or higher to inject arbitrary web scripts into pages. These injected scripts execute whenever other users access the compromised pages, posing a significant security risk for WordPress sites utilizing this plugin.

References