Cross-Site Scripting Vulnerability in WordPress Animated Counters Plugin

CVE-2024-11905

What is CVE-2024-11905?

The Animated Counters plugin for WordPress is affected by a Stored Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitization and output escaping in the 'animatedcounte' shortcode. This flaw exists in all versions up to and including 2.0, allowing authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. When users access these compromised pages, the injected scripts execute, potentially leading to data theft or other malicious activities. Website administrators using this plugin should take immediate action to update to the latest version and implement security measures to mitigate the risk of exploitation.

References