Stored Cross-Site Scripting Vulnerability in Front End Users Plugin for WordPress

CVE-2024-13563

Summary

The Front End Users plugin for WordPress contains a vulnerability that allows authenticated attackers with contributor-level access or higher to exploit stored cross-site scripting (XSS) via the plugin's forgot-password shortcode. This issue arises from inadequate input sanitization and output escaping of user-supplied attributes. If successfully exploited, this vulnerability permits the injection of arbitrary web scripts into pages, leading to execution whenever a user accesses a compromised page. It is essential for site administrators to review their installations immediately and apply necessary updates to mitigate these risks.

References