Stored Cross-Site Scripting Vulnerability in C9 Admin Dashboard Plugin for WordPress

CVE-2024-13379

What is CVE-2024-13379?

The C9 Admin Dashboard plugin for WordPress suffers from a Stored Cross-Site Scripting (XSS) vulnerability. This issue arises from inadequate input sanitization and output escaping, allowing authenticated users with Author-level access and higher to upload SVG files containing malicious scripts. When other users access these files, the scripts execute in their browsers, potentially compromising user data and security. This vulnerability impacts all versions up to and including 1.3.5, emphasizing the need for using updated versions and implementing security best practices to mitigate risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References