Stored Cross-Site Scripting Vulnerability in WP Responsive Tabs Plugin by WordPress
CVE-2024-13387

6.4MEDIUM

Key Information:

Vendor
Wordpress
Status
WP Responsive Tabs
Vendor
CVE Published:
16 January 2025

Summary

The WP Responsive Tabs plugin for WordPress is impacted by a vulnerability that allows for stored cross-site scripting through the 'wprtabs' shortcode. This issue arises from inadequate input sanitization and output escaping on user-supplied attributes. Authenticated attackers with contributor-level access or higher can exploit this flaw to inject malicious web scripts into pages. When users access an affected page, the injected scripts can execute, potentially compromising user data and site integrity. Thus, updating the plugin to the latest version is imperative to safeguard against this vulnerability.

Affected Version(s)

WP Responsive Tabs * <= 1.2.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SOPROBRO
.