Stored XSS Vulnerability in UMich OIDC Login Plugin for WordPress

CVE-2024-11753

What is CVE-2024-11753?

The UMich OIDC Login plugin for WordPress is affected by a stored cross-site scripting vulnerability due to a lack of adequate input sanitization and output escaping in its 'umich_oidc_button' shortcode. This vulnerability allows authenticated attackers with contributor-level access or higher to inject harmful web scripts into pages that execute whenever users visit those pages. It is imperative for users of versions up to and including 1.2.0 of the plugin to take action to protect their sites from potential exploits.

References