Stored Cross-Site Scripting Vulnerability in Sydney Toolbox Plugin

CVE-2024-2936

What is CVE-2024-2936?

The Sydney Toolbox plugin for WordPress experiences a vulnerability that allows authenticated attackers, holding contributor-level access or higher, to exploit Stored Cross-Site Scripting through the _id attribute of widgets. This occurs because of inadequate input sanitization and output escaping on user-supplied attributes, enabling the injection of arbitrary web scripts. Users visiting affected pages may unknowingly execute these scripts, leading to potential data manipulation or exposure.

References