Stored Cross-Site Scripting Vulnerability Affects NewsmanApp Plugin for WordPress
CVE-2024-11767

6.4MEDIUM

Key Information:

Vendor: Wordpress
Status: Newsmanapp
Vendor: CVE Published:; 13 December 2024

Summary

The NewsmanApp plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability via the 'newsman_subscribe_widget' shortcode. This vulnerability arises from inadequate input sanitization and output escaping on user-supplied attributes, allowing authenticated attackers with contributor-level access or higher to inject arbitrary scripts. Such scripts are executed whenever a user accesses the manipulated page, creating potential for harmful actions and data compromise.

Affected Version(s)

NewsmanApp * <= 2.7.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/browser/newsmanapp/tru...

CVSS V3.1

Score:

6.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Changed

Timeline

Vulnerability published
Dec 13, 2024
Vulnerability Reserved
Nov 26, 2024

Credit

muhammad yudha