Stored Cross-Site Scripting Vulnerability in Spoki Chat Buttons and WooCommerce Notifications Plugin

CVE-2024-11893

What is CVE-2024-11893?

CVE-2024-11893 is a severe stored cross-site scripting vulnerability identified in the Spoki Chat Buttons and WooCommerce Notifications plugin for WordPress. This flaw arises from inadequate input sanitization and output escaping of user-supplied attributes in the 'spoki_button' shortcode. It affects all versions of the plugin up to and including 2.15.14. Authenticated attackers with contributor-level access can exploit this vulnerability to inject arbitrary web scripts into web pages. As a result, malicious scripts can execute when users access compromised pages, posing significant risks to website integrity and user data.

References