Stored Cross-Site Scripting in Simple Banner Plugin for WordPress
CVE-2024-12769
Key Information:
- Vendor
- WordPress
- Status
- Vendor
- CVE Published:
- 25 March 2025
Badges
Summary
The Simple Banner plugin for WordPress, versions prior to 3.0.4, fails to properly sanitize and escape certain configuration settings. This oversight permits users with elevated privileges, such as administrators, to execute Stored Cross-Site Scripting (XSS) attacks. Even in multisite environments where the unfiltered_html capability is restricted, attackers could exploit this vulnerability to inject malicious scripts, compromising the security of the site and potentially affecting visitors.
Affected Version(s)
Simple Banner 0 < 3.0.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved