Stored Cross-Site Scripting Vulnerability in Plethora Plugins Tabs + Accordions for WordPress

CVE-2024-13721

What is CVE-2024-13721?

The Plethora Plugins Tabs + Accordions plugin for WordPress is exposed to a Stored Cross-Site Scripting vulnerability due to improper input sanitization and output escaping in the anchor parameter. This flaw affects all versions up to and including 1.1.8, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary scripts into WordPress pages. Consequently, these scripts can execute in the context of users accessing the compromised pages, posing a significant risk to site integrity and user safety.

References