Stored Cross-Site Scripting Vulnerability in HTML5 Chat Plugin for WordPress

CVE-2024-12451

What is CVE-2024-12451?

The HTML5 Chat Plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability. This issue is caused by inadequate input sanitization and output escaping related to the plugin's 'HTML5CHAT' shortcode. Authenticated users with contributor-level access or higher can exploit this weakness, enabling them to inject arbitrary JavaScript code into website pages. As a result, malicious scripts may execute when unsuspecting users visit the affected pages, potentially compromising user data and web application integrity.

References