Cross-site Scripting Vulnerability in Arconix Shortcodes by Tyche Softwares
CVE-2024-56242

6.5MEDIUM

Key Information:

Vendor
WordPress
Status
Arconix Shortcodes
Vendor
CVE Published:
2 January 2025

Summary

The vulnerability stems from improper neutralization of input during the generation of web pages within Arconix Shortcodes by Tyche Softwares. This flaw allows an attacker to exploit stored Cross-site Scripting (XSS) vulnerabilities, potentially leading to unauthorized access to user data and session hijacking. The affected versions include all preceding 2.1.14, enabling malicious scripts to be persisted within webpage content.

Affected Version(s)

Arconix Shortcodes <= 2.1.14

References

https://patchstack.com/database/wordpress/plugin/arconix-...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Thaleikis (Patchstack Alliance)
.