Stored Cross-Site Scripting Vulnerability in WP Post List Table Plugin for WordPress
CVE-2024-13664

5.4MEDIUM

Key Information:

Vendor
WPbean
Status
WP Post List Table
Vendor
CVE Published:
30 January 2025

Summary

The WP Post List Table plugin for WordPress has a vulnerability that allows authenticated users with contributor-level access and above to perform Stored Cross-Site Scripting (XSS) attacks. This issue arises from inadequate input validation and output encoding on attributes supplied by users in the 'wpb_post_list_table' shortcode. As a result, attackers can inject arbitrary web scripts into pages, which will execute whenever those pages are accessed by users. This could lead to unauthorized actions and data exposure, emphasizing the importance of updating to the latest version to mitigate potential risks.

Affected Version(s)

WP Post List Table * <= 1.0.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3227735/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Thaleikis
.