Stored Cross-Site Scripting Vulnerability in ScanCircle Plugin for WordPress

Summary

CVE-2024-11439 identifies a Stored Cross-Site Scripting (XSS) vulnerability in the ScanCircle plugin for WordPress. This vulnerability exists due to inadequate input sanitization and output escaping practices on user-supplied attributes within the plugin's 'scancircle' shortcode. As a result, authenticated attackers with contributor-level access or higher can inject harmful web scripts into pages. These scripts execute whenever users access the affected pages, potentially compromising user data and site integrity. It is crucial for site administrators to update the plugin to mitigate this security risk.

References