Stored Cross-Site Scripting in Frictionless Plugin for WordPress

CVE-2024-13396

What is CVE-2024-13396?

The Frictionless plugin for WordPress is susceptible to Stored Cross-Site Scripting due to a lack of adequate input sanitization and output escaping on user-supplied attributes in the 'frictionless_form' shortcodes. This vulnerability affects all versions up to and including 0.0.23, enabling authenticated attackers with contributor-level access and above to inject arbitrary web scripts into web pages. This can lead to malicious scripts being executed when users access these compromised pages, posing significant security risks to both the site and its users.

References