Grey Owl Lightbox Plugin Vulnerable to Stored Cross-Site Scripting

CVE-2024-11440

What is CVE-2024-11440?

The Grey Owl Lightbox plugin for WordPress exhibits vulnerability to Stored Cross-Site Scripting (XSS) stemming from insufficient input sanitization and output escaping of user-supplied attributes in the 'gol_button' shortcode. This flaw affects all releases up to and including version 1.6.1. Authenticated users with contributor-level access and higher can exploit this vulnerability to inject arbitrary scripts into web pages, leading to execution whenever a user accesses the compromised page. Potential consequences include session hijacking, defacement, or the distribution of malware, presenting a significant risk to website integrity and user security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References