Stored Cross-Site Scripting Vulnerability in Slider Pro Lite Plugin for WordPress

CVE-2024-11899

What is CVE-2024-11899?

The Slider Pro Lite plugin for WordPress allows authenticated users with contributor-level access and above to exploit a vulnerability through the 'sliderpro' shortcode. This occurs due to insufficient input sanitization and output escaping for user-supplied attributes. Attackers can inject arbitrary web scripts, which execute whenever a user visits an affected page, potentially leading to the theft of sensitive information or other malicious activities.

References