Stored Cross-Site Scripting Vulnerability in WordPress Favorites Plugin
CVE-2024-2948

7.2HIGH

Key Information:

Vendor
Wordpress
Status
Favorites
Vendor
CVE Published:
30 March 2024

Summary

The Favorites plugin for WordPress is susceptible to a stored cross-site scripting vulnerability. This issue arises from inadequate sanitization of user input and improper escaping of output, particularly in the plugin's 'user_favorites' shortcode. Authenticated attackers with contributor-level access or higher can exploit this flaw to inject arbitrary JavaScript into pages. This injected code executes whenever a user accesses impacted pages, posing significant security risks to site visitors and highlighting the importance of input validation in web applications.

Affected Version(s)

Favorites * <= 2.3.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Krzysztof Zając
.