Stored Cross-Site Scripting Vulnerability in Trackserver Plugin for WordPress

CVE-2024-12505

Summary

The Trackserver plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate sanitization and escaping of user inputs in the 'tsmap' shortcode. This security flaw allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. As a result, any user accessing these compromised pages may inadvertently execute malicious scripts, potentially leading to unauthorized actions and data exposure.

References