Stored Cross-Site Scripting in Threepress Plugin for WordPress

CVE-2024-13395

What is CVE-2024-13395?

The Threepress plugin for WordPress is vulnerable to Stored Cross-Site Scripting through its 'threepress' shortcode in all versions up to 1.7.1. This issue arises from inadequate input sanitization and output escaping on attributes supplied by users. Authenticated attackers with contributor-level access and above can exploit this vulnerability, allowing them to inject malicious web scripts into pages. These scripts will execute in the browsers of users who access the compromised pages, posing significant security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References