Stored Cross-Site Scripting Vulnerability in CanadaHelps Embedded Donation Form Plugin for WordPress

CVE-2024-11778

Summary

The CanadaHelps Embedded Donation Form plugin allows for stored cross-site scripting vulnerabilities due to inadequate sanitization and escaping of user-supplied attributes in the 'embedcdn' shortcode. This issue affects all versions up to and including 1.0.0, enabling authenticated attackers with contributor-level access or higher to insert arbitrary web scripts. As a result, these scripts execute whenever a user accesses a compromised page, potentially leading to harmful consequences such as data theft or session hijacking.

References