Stored Cross-Site Scripting Vulnerability in PowerBI Embed Reports Plugin

CVE-2024-11901

What is CVE-2024-11901?

The PowerBI Embed Reports plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability. This flaw arises from inadequate sanitization of user inputs and improper output escaping in the plugin's 'MO_API_POWER_BI' shortcode across all versions up to 1.1.7. Authenticated users with contributor-level access and higher may exploit this vulnerability to inject arbitrary web scripts. These scripts execute whenever a user accesses the compromised page, potentially leading to significant security risks for website visitors.

References