Stored Cross-Site Scripting in Frictionless Plugin for WordPress

CVE-2024-13396

What is CVE-2024-13396?

The Frictionless plugin for WordPress is susceptible to Stored Cross-Site Scripting due to a lack of adequate input sanitization and output escaping on user-supplied attributes in the 'frictionless_form' shortcodes. This vulnerability affects all versions up to and including 0.0.23, enabling authenticated attackers with contributor-level access and above to inject arbitrary web scripts into web pages. This can lead to malicious scripts being executed when users access these compromised pages, posing significant security risks to both the site and its users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References