Stored Cross-Site Scripting Vulnerability in Spoki Chat Buttons and WooCommerce Notifications Plugin
CVE-2024-11893

6.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Spoki – Chat Buttons And WooCommerce Notifications
Vendor
CVE Published:
20 December 2024

Summary

CVE-2024-11893 is a severe stored cross-site scripting vulnerability identified in the Spoki Chat Buttons and WooCommerce Notifications plugin for WordPress. This flaw arises from inadequate input sanitization and output escaping of user-supplied attributes in the 'spoki_button' shortcode. It affects all versions of the plugin up to and including 2.15.14. Authenticated attackers with contributor-level access can exploit this vulnerability to inject arbitrary web scripts into web pages. As a result, malicious scripts can execute when users access compromised pages, posing significant risks to website integrity and user data.

Affected Version(s)

Spoki – Chat Buttons and WooCommerce Notifications * <= 2.15.14

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/spoki/trunk/sp...
https://wordpress.org/plugins/spoki/

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Youcef Hamdani
.