Reflected Cross-Site Scripting Vulnerability in Team Rosters Plugin for WordPress

CVE-2024-12320

What is CVE-2024-12320?

The Team Rosters plugin for WordPress has a vulnerability that allows attackers to execute arbitrary scripts within a user's session. By exploiting the 'tab' parameter, attackers can launch reflected cross-site scripting attacks due to inadequate input sanitization and output escaping. This vulnerability permits unauthenticated attackers to lure users into clicking manipulated links, thereby injecting malicious scripts into webpages they view, posing risks to user data and website integrity.

References