Stored Cross-Site Scripting in RSS Icon Widget Plugin for WordPress

CVE-2024-12203

Summary

The RSS Icon Widget plugin for WordPress is susceptible to stored cross-site scripting through the 'link_color' parameter due to inadequate input sanitization and output escaping. This vulnerability allows authenticated attackers, specifically those with administrator-level access, to inject malicious web scripts that get executed whenever users access the compromised page. It particularly impacts multi-site installations and setups where unfiltered_html has been disabled, raising serious security concerns for affected sites.

References