Stored Cross-Site Scripting Vulnerability in Geo Content Plugin for WordPress
CVE-2024-11887
6.4MEDIUM
Key Information:
- Vendor
Wordpress
- Status
- Vendor
- CVE Published:
- 7 January 2025
What is CVE-2024-11887?
The Geo Content plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting (XSS) via the 'geotargetlygeocontent' shortcode. This issue affects all versions up to and including 6.0. Due to inadequate input sanitization and output escaping mechanisms, authenticated attackers with contributor-level access can exploit this flaw. By injecting arbitrary web scripts into content managed by the plugin, these scripts may execute whenever a user visits the compromised page, potentially leading to session hijacking or defacement.
Affected Version(s)
Geo Content * <= 6.0