Plugin vulnerability puts WordPress websites at risk of Stored Cross-Site Scripting attacks

CVE-2024-2430

5.4MEDIUM

Key Information

Vendor: WordPress
Status: Website Content In Page Or Post
Vendor: CVE Published:; 12 July 2024

Summary

The Website Content in Page or Post WordPress plugin before 2024.04.09 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affected Version(s)

Website Content in Page or Post < 2024.04.09

CVSS V3.1

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published.
Jul 12, 2024
Vulnerability Reserved.
Mar 13, 2024

Collectors

NVD DatabaseMitre Database

Credit

Ayush Juneja

WPScan