Cross-Site Scripting Vulnerability in Image Widget Plugin for WordPress
CVE-2024-10939
Key Information:
- Vendor
Wordpress
- Status
- Vendor
- CVE Published:
- 13 December 2024
Badges
What is CVE-2024-10939?
CVE-2024-10939 is a significant Cross-Site Scripting (XSS) vulnerability found in the Image Widget plugin for WordPress prior to version 4.4.11. This vulnerability arises from the plugin's failure to properly sanitize and escape certain settings associated with the Image Widget, creating an opportunity for high privilege users, such as administrators, to execute stored XSS attacks. Such attacks can occur even in configurations where the unfiltered_html capability is disabled, notably in multisite setups. This oversight poses a serious risk to user data and site integrity, urging WordPress site administrators to update their plugins promptly to mitigate potential exploits.
Affected Version(s)
Image Widget 0 < 4.4.11
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.