Plugin Vulnerability: Stored Cross-Site Scripting (XSS) in Advanced WordPress Backgrounds

CVE-2024-8045

Summary

The Advanced WordPress Backgrounds plugin for WordPress has a vulnerability that allows authenticated attackers with Contributor-level access or above to exploit an insufficient input sanitization and output escaping flaw via the ‘imageTag’ parameter. By injecting arbitrary web scripts into pages, attackers can manipulate the content delivered to users who access those pages, potentially leading to session hijacking, data theft, or other malicious actions. This vulnerability highlights the importance of robust code validation and user input sanitization within web applications.

References