Stored Cross-Site Scripting Vulnerability in Mini Course Generator Plugin for WordPress
CVE-2024-13672

6.4MEDIUM

Key Information:

Vendor
Minicoursegenerator
Status
Mini Course Generator | Embed Mini-courses And Interactive Content
Vendor
CVE Published:
21 February 2025

Summary

The Mini Course Generator plugin for WordPress is prone to a Stored Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitization and output escaping on the 'mcg' shortcode. This flaw allows authenticated attackers with contributor-level access and above to inject malicious web scripts into web pages. The scripts will execute when users load such pages, leading to potential data theft or unauthorized actions, compromising the site’s integrity. This vulnerability affects all versions up to and including 1.0.5.

Affected Version(s)

Mini Course Generator | Embed mini-courses and interactive content * <= 1.0.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/mini-course-ge...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Thaleikis
.