Stored Cross-Site Scripting Vulnerability Affects NewsmanApp Plugin for WordPress
CVE-2024-11767
6.4MEDIUM
What is CVE-2024-11767?
The NewsmanApp plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability via the 'newsman_subscribe_widget' shortcode. This vulnerability arises from inadequate input sanitization and output escaping on user-supplied attributes, allowing authenticated attackers with contributor-level access or higher to inject arbitrary scripts. Such scripts are executed whenever a user accesses the manipulated page, creating potential for harmful actions and data compromise.
Affected Version(s)
NewsmanApp * <= 2.7.6