Category Dropdown Plugin Vulnerable to Stored Cross-Site Scripting

CVE-2024-8103

What is CVE-2024-8103?

The WP Category Dropdown plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability, exploited through the 'align' parameter. This flaw arises from inadequate input sanitization and insufficient output escaping in all versions up to and including 1.8. Authenticated attackers with Contributor-level access or higher can leverage this vulnerability to inject arbitrary web scripts, which execute automatically when users access the compromised pages. This attack vector poses significant risks, particularly for sites that rely on this plugin for categorizing content.

References