Stored Cross-Site Scripting Vulnerability in WPRadio WordPress Plugin

CVE-2024-13397

What is CVE-2024-13397?

The WPRadio plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through its 'wpradio_player' shortcode. This flaw allows authenticated attackers with contributor-level access and above to exploit insufficient input sanitization and output escaping on user-supplied attributes, enabling them to inject arbitrary web scripts. Consequently, when other users access compromised pages, the malicious scripts are executed, posing significant risks to site security and user data integrity.

References