Stored Cross-Site Scripting Vulnerability in Multi-column Tag Map Plugin for WordPress

CVE-2024-11196

Summary

The Multi-column Tag Map plugin for WordPress contains a high-risk Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-11196. This vulnerability stems from inadequate input sanitization and output escaping for user-supplied attributes in the plugin's 'mctagmap' shortcode. As a result, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, resulting in the execution of malicious scripts when unsuspecting users visit the compromised pages. This presents a significant security risk, urging all users of affected versions (up to 17.0.33) to apply the necessary updates and patches promptly.

References