Stored Cross-Site Scripting Vulnerability in Music Sheet Viewer Plugin for WordPress

CVE-2024-13670

What is CVE-2024-13670?

The Music Sheet Viewer plugin for WordPress contains a vulnerability that allows attackers to exploit stored cross-site scripting via the 'pn_msv' shortcode. This issue arises from inadequate input sanitization and output escaping of user-supplied attributes. By leveraging this weakness, attackers who have contributor-level access or above can inject malicious web scripts into pages. The consequence of this vulnerability is that any user accessing the compromised page will execute the injected script, which could lead to data theft, session hijacking, or distribution of malware.

References