Stored Cross-Site Scripting in RSS Icon Widget Plugin for WordPress

CVE-2024-12203

What is CVE-2024-12203?

The RSS Icon Widget plugin for WordPress is susceptible to stored cross-site scripting through the 'link_color' parameter due to inadequate input sanitization and output escaping. This vulnerability allows authenticated attackers, specifically those with administrator-level access, to inject malicious web scripts that get executed whenever users access the compromised page. It particularly impacts multi-site installations and setups where unfiltered_html has been disabled, raising serious security concerns for affected sites.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References