Stored Cross-Site Scripting Vulnerability in WordPress Plugin by Vendor
CVE-2024-2643
What is CVE-2024-2643?
The Sticky Menu on Scroll, Announcement Banner, and Sticky Header plugin for WordPress prior to version 2.6.8 has been identified to allow high privilege users, such as administrators, to execute stored Cross-Site Scripting (XSS) attacks. This occurs due to the ineffective sanitization and escaping of certain settings, opening vulnerabilities in configurations that should restrict unfiltered HTML capability. This can be particularly concerning in multisite setups.
Affected Version(s)
Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any Theme 0 < 2.6.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.