Reflected Cross-Site Scripting Vulnerability in Post Sync Plugin by WordPress
CVE-2024-13634
Key Information:
Badges
Summary
The Post Sync WordPress plugin versions up to 1.1 is susceptible to a reflected cross-site scripting vulnerability. This occurs because the plugin fails to properly sanitize and escape user-supplied parameters before rendering them in the web page output. As a result, malicious actors can exploit this flaw to inject harmful scripts into the browser of high privilege users, such as administrators. This can potentially lead to unauthorized actions being performed or sensitive information being exposed.
Affected Version(s)
Post Sync 0 <= 1.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved