Stored Cross-Site Scripting in Stockdio Historical Chart Plugin for WordPress

CVE-2024-13349

What is CVE-2024-13349?

The Stockdio Historical Chart plugin for WordPress contains a vulnerability that allows authenticated users with contributor-level access and higher to exploit the 'stockdio-historical-chart' shortcode. Due to inadequate input sanitization and output escaping of user-supplied attributes, attackers can inject arbitrary web scripts. These scripts may execute when users access compromised pages, posing a significant threat to website integrity and user trust.

References