Stored Cross-Site Scripting Vulnerability in Social Auto Poster plugin

CVE-2024-6753

What is CVE-2024-6753?

The Social Auto Poster plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting via the 'mapTypes' parameter in the 'wpw_auto_poster_map_wordpress_post_type' AJAX function. This security flaw arises from inadequate input sanitization and output escaping, enabling unauthenticated attackers to inject malicious web scripts. These scripts can execute in the browser of any user accessing the compromised page, leading to potential data breaches or hijacking of user sessions. It is crucial for users of the plugin to apply necessary updates or patches to mitigate the risk associated with this vulnerability.

References