Stored Cross-Site Scripting in Stylish Price List Plugin for WordPress
CVE-2024-7758
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 15 May 2025
Badges
What is CVE-2024-7758?
The Stylish Price List WordPress plugin, prior to version 7.1.8, contains a vulnerability that fails to properly sanitize and escape certain settings. This oversight enables users with high privileges (contributors and above) to execute Stored Cross-Site Scripting (XSS) attacks, even when the unfiltered_html capability is restricted, particularly in multisite environments. This vulnerability poses significant risks, allowing malicious users to inject harmful scripts into web pages, potentially compromising site integrity and user data.
Affected Version(s)
Stylish Price List 0 < 7.1.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved