Stored Cross-Site Scripting in FuseDesk Plugin for WordPress

CVE-2024-13459

What is CVE-2024-13459?

The FuseDesk plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) attacks via the 'fusedesk_newcase' shortcode. This vulnerability arises from inadequate input sanitization and output escaping on attributes supplied by users. Attackers with contributor-level access and higher can exploit this flaw to inject malicious web scripts into pages viewed by other users, leading to potential session hijacking, data theft, or page defacement whenever an infected page is accessed.

References