Stored Cross-Site Scripting Vulnerability Affects BMLT Tabbed Map Plugin

CVE-2024-11866

What is CVE-2024-11866?

The BMLT Tabbed Map plugin for WordPress faces a significant Stored Cross-Site Scripting issue due to inadequate input sanitization and output escaping on user-supplied attributes within its 'bmlt_tabbed_map' shortcode. This vulnerability allows attackers with contributor-level access or higher to inject arbitrary web scripts into the pages. Consequently, any user who accesses the affected page may unknowingly execute the injected script, potentially compromising their session and exposing sensitive information.

References