Stored Cross-Site Scripting Vulnerability in Easy Accordion FAQ Plugin for WordPress
CVE-2024-1363

6.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Easy Accordion – Best Accordion Faq Plugin For WordPress
Vendor
CVE Published:
13 March 2024

Summary

The Easy Accordion – Best Accordion FAQ Plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping within the 'accordion_content_source' attribute. This vulnerability enables authenticated users, possessing contributor-level access or higher, to inject malicious web scripts. These scripts can execute whenever a user accesses the compromised pages, posing significant security risks to site users.

Affected Version(s)

Easy Accordion – Best Accordion FAQ Plugin for WordPress * <= 2.3.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ngô Thiên An
.