Stored Cross-Site Scripting Vulnerability in ADFO Plugin for WordPress
CVE-2024-13390

6.4MEDIUM

Key Information:

Vendor
WordPress
Status
Adfo – Custom Data In Admin Dashboard
Vendor
CVE Published:
19 February 2025

Summary

The ADFO – Custom data in admin dashboard plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability, affecting all versions up to and including 1.9.1. This vulnerability arises due to inadequate input sanitization and output escaping of attributes supplied by users through the plugin's 'adfo_list' shortcode. As a result, authenticated attackers with contributor-level access or higher can inject malicious web scripts into pages. These injected scripts are executed whenever a user accesses the affected pages, potentially leading to unauthorized actions or data theft.

Affected Version(s)

ADFO – Custom data in admin dashboard * <= 1.9.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/admin-form/

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SOPROBRO
.