Cross-Site Scripting Vulnerability in WordPress Animated Counters Plugin
CVE-2024-11905

6.4MEDIUM

Key Information:

Vendor
Wordpress
Vendor
CVE Published:
17 December 2024

Summary

The Animated Counters plugin for WordPress is affected by a Stored Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitization and output escaping in the 'animatedcounte' shortcode. This flaw exists in all versions up to and including 2.0, allowing authenticated attackers with contributor-level access or higher to inject malicious scripts into web pages. When users access these compromised pages, the injected scripts execute, potentially leading to data theft or other malicious activities. Website administrators using this plugin should take immediate action to update to the latest version and implement security measures to mitigate the risk of exploitation.

Affected Version(s)

Animated Counters * <= 2.0

References

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

Credit

Youcef Hamdani
.