Reflected Cross-Site Scripting in Stylish Google Sheet Reader Plugin for WordPress
CVE-2024-13863
Summary
The Stylish Google Sheet Reader plugin for WordPress versions prior to 4.1 contains a vulnerability where user-supplied input is not properly sanitized or escaped before being rendered on the web page. This oversight can lead to Reflected Cross-Site Scripting (XSS) attacks, allowing malicious actors to execute scripts in the browser of users with high privileges, such as administrators. As a result, attackers can potentially steal sensitive information or manipulate site settings.
Affected Version(s)
Stylish Google Sheet Reader 4.0 0 < 4.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved