Stored Cross-Site Scripting Vulnerability in Outdooractive Embed Plugin for WordPress

CVE-2024-11774

Summary

The Outdooractive Embed plugin for WordPress has a High severity Stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2024-11774. This vulnerability arises from inadequate input sanitization and output escaping in the 'list2go' shortcode, affecting all versions up to and including 1.5. Authenticated attackers with contributor-level access or higher can exploit this flaw to inject malicious scripts into web pages. Once injected, these scripts can execute whenever a user accesses the compromised page, potentially leading to account compromise, data theft, or spreading malware. It is crucial for users of this plugin to update to the latest version and implement security measures to protect their web applications from XSS attacks.

References