Stored Cross-Site Scripting in WordPress Plugins Using Magnific Popups Library

CVE-2024-5647

What is CVE-2024-5647?

Multiple WordPress plugins are vulnerable to Stored Cross-Site Scripting through the bundled Magnific Popups library, specifically versions prior to 1.2.0. This issue arises from insufficient sanitization and escaping of user-supplied attributes, allowing authenticated users with contributor-level privileges to insert arbitrary scripts. When these scripts are executed, they can compromise user sessions and data integrity upon accessing the affected pages. This vulnerability was mitigated in version 1.2.0 of the Magnific Popups library, which introduced measures to prevent HTML loading in sensitive fields by default.

References