Stored Cross-Site Scripting Vulnerability in WP Responsive Tabs Plugin by WordPress
CVE-2024-13387
6.4MEDIUM
What is CVE-2024-13387?
The WP Responsive Tabs plugin for WordPress is impacted by a vulnerability that allows for stored cross-site scripting through the 'wprtabs' shortcode. This issue arises from inadequate input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access or higher can exploit this flaw to inject malicious web scripts into pages. When users access an affected page, the injected scripts can execute, potentially compromising user data and site integrity. Thus, updating the plugin to the latest version is imperative to safeguard against this vulnerability.
Affected Version(s)
WP Responsive Tabs * <= 1.2.9