Stored Cross-Site Scripting Vulnerability in Phlox Theme Plugin for WordPress

CVE-2024-1533

Summary

The Phlox theme plugin for WordPress contains a vulnerability that enables stored cross-site scripting (XSS) due to inadequate input sanitization and output escaping methods. This flaw impacts all versions of the plugin up to and including version 2.15.5. Authenticated attackers with contributor privileges or higher can exploit this vulnerability to inject malicious web scripts into pages. These scripts will execute whenever a user accesses the compromised page, potentially leading to unauthorized actions and data theft. The exploitation requires both the Elementor and the Phlox theme to be installed, making it crucial for users to apply security measures.

References