Stored Cross-Site Scripting Vulnerability in Front End Users Plugin

CVE-2024-7606

Summary

The Front End Users plugin for WordPress contains a vulnerability that permits Stored Cross-Site Scripting (XSS) through the 'user-search' shortcode. This issue stems from inadequate input sanitization and output escaping for user-supplied attributes. Authenticated users with contributor-level access or higher can exploit this flaw to inject malicious scripts into web pages. These scripts execute when other users access the affected pages, potentially compromising user data and overall site security.

References