Stored Cross-Site Scripting in WordPress Plugins Using Magnific Popups Library

CVE-2024-5647

What is CVE-2024-5647?

Multiple WordPress plugins are vulnerable to Stored Cross-Site Scripting through the bundled Magnific Popups library, specifically versions prior to 1.2.0. This issue arises from insufficient sanitization and escaping of user-supplied attributes, allowing authenticated users with contributor-level privileges to insert arbitrary scripts. When these scripts are executed, they can compromise user sessions and data integrity upon accessing the affected pages. This vulnerability was mitigated in version 1.2.0 of the Magnific Popups library, which introduced measures to prevent HTML loading in sensitive fields by default.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References