Plugin Vulnerable to Stored Cross-Site Scripting
CVE-2024-11388

5.4MEDIUM

Key Information:

Vendor

Wordpress
Status
Dino Game – Embed Google Chrome Dinosaur Game In WordPress
Vendor
CVE Published:
21 November 2024

What is CVE-2024-11388?

The Dino Game plugin for WordPress is exposed to a stored cross-site scripting vulnerability through its 'dino-game' shortcode. This issue arises from the plugin's lack of sufficient input sanitization and output escaping for user-supplied attributes. Authenticated attackers with contributor-level access or higher are able to exploit this vulnerability to inject arbitrary web scripts. These scripts can execute whenever users visit the compromised pages, potentially leading to various malicious actions, including session hijacking and website defacement.

Affected Version(s)

Dino Game – Embed Google Chrome Dinosaur Game in WordPress * <= 1.1.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/dino-game/trun...

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SOPROBRO
.