Stored Cross-Site Scripting Vulnerability in SVS Pricing Tables for WordPress

CVE-2024-2958

What is CVE-2024-2958?

The SVS Pricing Tables plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate sanitization of inputs and escaping of outputs in the pricing table settings. This vulnerability affects all versions up to and including 1.0.4, allowing authenticated attackers with administrator-level permissions to inject malicious web scripts. These scripts can execute whenever a user accesses an impacted page. It's particularly relevant for multi-site environments and those where the 'unfiltered_html' capability has been disabled, heightening the risk of exploitation.

References