Cross-site Scripting Vulnerability in EazyDocs Product

CVE-2024-38720

Summary

A significant security flaw has been detected in the EazyDocs plugin for WordPress, allowing an attacker to exploit improper input neutralization during web page generation. This vulnerability enables stored cross-site scripting (XSS) attacks, where malicious scripts can be injected and stored within the application. Affected users, running versions up to 2.5.0, are at risk as attackers can potentially execute arbitrary JavaScript in the context of the affected user's session. It is crucial for users to update their installations and apply necessary security patches to safeguard against such threats.

References