Stored Cross-Site Scripting Vulnerability in Sydney Toolbox Plugin for WordPress
CVE-2024-3208

6.4MEDIUM

Key Information:

Vendor
Wordpress
Status
Sydney Toolbox
Vendor
CVE Published:
9 April 2024

Summary

The Sydney Toolbox plugin for WordPress contains a Stored Cross-Site Scripting vulnerability found in the Filterable Gallery widget. This vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes. As a result, authenticated attackers with contributor-level access and above can inject malicious scripts into pages, which are executed when users access those compromised pages. This vulnerability underscores the importance of rigorous security measures to protect web applications from potentially harmful scripts.

Affected Version(s)

Sydney Toolbox * <= 1.28

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

wesley
.