WordPress Plum: Spin Wheel & Email Pop-up plugin <= 2.0 - Broken Access Control to Unauth Stored XSS vulnerability

CVE-2024-38744

What is CVE-2024-38744?

The Upqode Plum: Spin Wheel & Email Pop-up experiences a critical issue where missing authorization checks allow unauthorized users to access certain functionalities. This vulnerability also exposes the application to stored cross-site scripting (XSS) attacks, compromising user data and interaction integrity. The affected versions of this plugin range from an unspecified version up to 2.0, necessitating immediate attention and remediation for users to safeguard their data and maintain overall security.

References