Stored Cross-Site Scripting in Taskbuilder Plugin for WordPress
CVE-2024-11930
5.4MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 4 January 2025
What is CVE-2024-11930?
The Taskbuilder Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on user-supplied attributes within the plugin's wppm_tasks shortcode. This vulnerability affects all versions up to and including 3.0.6, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. Such scripts can be executed whenever a user accesses a compromised page, potentially leading to unauthorized actions and data exposure. Proper security measures and updates are critical in mitigating these risks.
Affected Version(s)
Taskbuilder – WordPress Project & Task Management plugin * <= 3.0.6