Stored Cross-Site Scripting Vulnerability in Advanced Sermons Plugin

CVE-2024-7599

Summary

The Advanced Sermons plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability, primarily due to insufficient input sanitization and output escaping in the handling of the 'sermon_video_embed' parameter. This security flaw affects all versions of the plugin up to and including version 3.3. Authenticated users with Contributor-level access and above can exploit this vulnerability to inject arbitrary web scripts into pages, which will be executed whenever a user visits the affected page. Immediate action is recommended to safeguard against potential exploitation, including updating to a secure version of the plugin and implementing robust security measures to prevent unauthorized script execution.

References