Stored Cross-Site Scripting Vulnerability in SecuPress Free WordPress Security Plugin by Web-Dorado

CVE-2024-9019

Summary

The SecuPress Free WordPress Security plugin is susceptible to Stored Cross-Site Scripting through its secupress_check_ban_ips_form shortcode. This vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes, enabling authenticated attackers with contributor-level access or higher to inject malicious web scripts. As a result, these scripts can execute on pages visited by users, posing a significant threat to site security. Users are advised to update to the latest version to mitigate this risk.

References