Stored Cross-Site Scripting Vulnerability in Taeggie Feed Plugin for WordPress

Summary

CVE-2024-11748 reveals a critical Stored Cross-Site Scripting (XSS) vulnerability in the Taeggie Feed plugin for WordPress, affecting all versions up to and including 0.1.9. Due to the lack of adequate input sanitization and output escaping on user-supplied attributes, authenticated attackers with contributor-level access can inject arbitrary scripts through the 'taeggie-feed' shortcode. These scripts will execute whenever a user views the affected page, potentially leading to data theft, session hijacking, or defacement of the website. It’s essential for WordPress administrator users to update to the latest version of the plugin to mitigate these risks.

References