Stored Cross-Site Scripting in Uncode Theme for WordPress

CVE-2024-13667

What is CVE-2024-13667?

The Uncode theme for WordPress is susceptible to a Stored Cross-Site Scripting issue through the 'mle-description' parameter. This vulnerability arises from inadequate input sanitization and output escaping in all versions up to and including 2.9.1.6. Authenticated attackers with Subscriber-level access or higher can exploit this flaw to inject arbitrary web scripts into pages. When a user accesses an affected page, the injected scripts will execute, potentially compromising user data and site integrity.

References