Stored Cross-Site Scripting in Taskbuilder Plugin for WordPress
CVE-2024-11930
6.4MEDIUM
Key Information:
- Vendor
- Wordpress
- Vendor
- CVE Published:
- 4 January 2025
Summary
The Taskbuilder Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on user-supplied attributes within the plugin's wppm_tasks shortcode. This vulnerability affects all versions up to and including 3.0.6, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. Such scripts can be executed whenever a user accesses a compromised page, potentially leading to unauthorized actions and data exposure. Proper security measures and updates are critical in mitigating these risks.
Affected Version(s)
Taskbuilder – WordPress Project & Task Management plugin * <= 3.0.6
References
CVSS V3.1
Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Peter Thaleikis