Stored Cross-Site Scripting Vulnerability in C9 Admin Dashboard Plugin for WordPress

CVE-2024-13379

Summary

The C9 Admin Dashboard plugin for WordPress suffers from a Stored Cross-Site Scripting (XSS) vulnerability. This issue arises from inadequate input sanitization and output escaping, allowing authenticated users with Author-level access and higher to upload SVG files containing malicious scripts. When other users access these files, the scripts execute in their browsers, potentially compromising user data and security. This vulnerability impacts all versions up to and including 1.3.5, emphasizing the need for using updated versions and implementing security best practices to mitigate risks.

References