Stored Cross-Site Scripting Vulnerability in WordPress Favorites Plugin

CVE-2024-2948

What is CVE-2024-2948?

The Favorites plugin for WordPress is susceptible to a stored cross-site scripting vulnerability. This issue arises from inadequate sanitization of user input and improper escaping of output, particularly in the plugin's 'user_favorites' shortcode. Authenticated attackers with contributor-level access or higher can exploit this flaw to inject arbitrary JavaScript into pages. This injected code executes whenever a user accesses impacted pages, posing significant security risks to site visitors and highlighting the importance of input validation in web applications.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References