Stored Cross-Site Scripting Vulnerability in Mini Course Generator Plugin for WordPress

CVE-2024-13672

What is CVE-2024-13672?

The Mini Course Generator plugin for WordPress is prone to a Stored Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitization and output escaping on the 'mcg' shortcode. This flaw allows authenticated attackers with contributor-level access and above to inject malicious web scripts into web pages. The scripts will execute when users load such pages, leading to potential data theft or unauthorized actions, compromising the site’s integrity. This vulnerability affects all versions up to and including 1.0.5.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References