Stored Cross-Site Scripting Vulnerability in Atarim Plugin for WordPress
CVE-2024-2793

7.2HIGH

Key Information:

Vendor
Wordpress
Status
Visual Website Collaboration, Feedback & Project Management – Atarim
Vendor
CVE Published:
31 May 2024

Summary

The Atarim Visual Website Collaboration, Feedback & Project Management plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting through comments. This security flaw exists in all versions up to and including 3.30, where improper sanitization of user inputs allows malicious actors to inject arbitrary web scripts. These scripts may execute whenever a user accesses the compromised page, posing significant risks to user security and website integrity.

Affected Version(s)

Visual Website Collaboration, Feedback & Project Management – Atarim * <= 3.30

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/atarim-visual-...
https://plugins.trac.wordpress.org/browser/atarim-visual-...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Robert DeVore
.