Stored Cross-Site Scripting in MailerLite Signup Forms Plugin for WordPress

CVE-2024-1386

What is CVE-2024-1386?

The MailerLite Signup Forms plugin for WordPress is susceptible to Stored Cross-Site Scripting attacks due to inadequate sanitization of user input and lack of proper output encoding on shortcode attributes. This vulnerability allows authenticated users with contributor-level permissions or higher to insert malicious scripts into web pages. When a victim accesses a page with the injected script, it executes in their browser, potentially compromising user data and session integrity.

References