Stored Cross-Site Scripting Vulnerability in Wishlist Plugin for WordPress

CVE-2024-12809

Summary

The Wishlist plugin for WordPress has a security flaw that permits Stored Cross-Site Scripting through the 'wishlist_button' shortcode. This vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes, leaving the plugin susceptible to script injection. Authenticated attackers with contributor-level access or higher can exploit this weakness, resulting in arbitrary web scripts being executed on affected pages whenever a user visits them. It is essential for users and administrators of the Wishlist plugin to update to the latest version to mitigate this risk.

References