Stored Cross-Site Scripting Vulnerability in eHive Objects Image Grid Plugin for WordPress

CVE-2024-13662

What is CVE-2024-13662?

The eHive Objects Image Grid plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) attacks. This vulnerability occurs through the plugin's 'ehive_objects_image_grid' shortcode, allowing authenticated attackers with contributor-level access or higher to inject malicious scripts into pages. The issues stem from inadequate sanitization of user inputs and insufficient escaping of outputs for attributes provided by users. This deficiency can lead to the execution of arbitrary web scripts each time a user accesses a compromised page, posing significant risks to site integrity and user safety.

References