Stored Cross-Site Scripting Vulnerability in WPRadio WordPress Plugin

CVE-2024-13397

What is CVE-2024-13397?

The WPRadio plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through its 'wpradio_player' shortcode. This flaw allows authenticated attackers with contributor-level access and above to exploit insufficient input sanitization and output escaping on user-supplied attributes, enabling them to inject arbitrary web scripts. Consequently, when other users access compromised pages, the malicious scripts are executed, posing significant risks to site security and user data integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References