Stored Cross-Site Scripting Vulnerability in Simple Banner Plugin for WordPress
CVE-2024-13898
4.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 4 April 2025
What is CVE-2024-13898?
The Simple Banner plugin for WordPress has a vulnerability that allows authenticated attackers with administrator-level permissions to exploit stored cross-site scripting through the admin settings. This issue arises from inadequate input sanitization and output escaping, exposing multi-site installations to risk, especially when unfiltered_html is disabled. By injecting arbitrary scripts, attackers can execute these scripts on pages viewed by users, compromising the overall security of the website.
Affected Version(s)
Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website * <= 3.0.4