Stored Cross-Site Scripting Vulnerability in Financial Calculator Plugin for WordPress

CVE-2024-11783

What is CVE-2024-11783?

CVE-2024-11783 is a critical Stored Cross-Site Scripting vulnerability found in the Financial Calculator plugin for WordPress. This issue arises from inadequate input sanitization and output escaping in user-supplied attributes, specifically via the 'finance_calculator' shortcode. Attackers with contributor-level access or higher can exploit this vulnerability to inject malicious scripts into web pages, which will execute each time a user visits the compromised page. This poses a significant risk to site integrity and user security, making it essential for site administrators to update to the latest version immediately to mitigate potential attacks.

References