Stored Cross-Site Scripting Vulnerability in Traffic Manager for WordPress

CVE-2024-7485

What is CVE-2024-7485?

The Traffic Manager plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) flaw through the 'page' parameter in the 'UserWebStat' AJAX function. This vulnerability arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to insert malicious web scripts. When users subsequently access a page tainted by this injection, the scripts will execute, potentially leading to unauthorized actions or data exposure. It is critical for users of all versions up to and including 1.4.5 to take immediate action to mitigate this risk.

References