Stored Cross-Site Scripting Vulnerability Affects NewsmanApp Plugin for WordPress

CVE-2024-11767

What is CVE-2024-11767?

The NewsmanApp plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability via the 'newsman_subscribe_widget' shortcode. This vulnerability arises from inadequate input sanitization and output escaping on user-supplied attributes, allowing authenticated attackers with contributor-level access or higher to inject arbitrary scripts. Such scripts are executed whenever a user accesses the manipulated page, creating potential for harmful actions and data compromise.

References