Stored Cross-Site Scripting Vulnerability in Automatically Hierarchic Categories in Menu Plugin for WordPress

CVE-2024-13466

Summary

The Automatically Hierarchic Categories in Menu plugin for WordPress is susceptible to stored cross-site scripting due to inadequate input sanitization and output escaping on user-supplied attributes. This vulnerability allows authenticated attackers, including those with contributor-level access and higher, to inject malicious scripts through the 'autocategorymenu' shortcode. When a user accesses an affected page, these scripts can execute, potentially compromising the security of the website and its users.

References