Stored Cross-Site Scripting in Store Locator Widget for WordPress

CVE-2024-13657

What is CVE-2024-13657?

The Store Locator Widget for WordPress is susceptible to a stored cross-site scripting vulnerability due to inadequate input sanitization and output escaping on attributes supplied by users through the 'storelocatorwidget' shortcode. This flaw enables authenticated attackers, with contributor-level permissions or higher, to inject arbitrary web scripts into pages. Consequently, any user who accesses these compromised pages may execute malicious scripts, posing significant security risks.

References