Stored Cross-Site Scripting Vulnerability in Elemenda Plugin for WordPress
CVE-2024-9373

5.4MEDIUM

Key Information:

Vendor
Themeid
Status
Elemenda
Vendor
CVE Published:
18 October 2024

Summary

The Elemenda plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitization and output escaping related to SVG file uploads. This vulnerability allows authenticated attackers with Author-level access and above to embed malicious scripts within SVG files. When a user accesses these files, the injected scripts can execute, potentially compromising the integrity of the site and the safety of user information. It is crucial for users and administrators to address this issue by updating to newer, secured versions of the plugin to prevent exploitation.

Affected Version(s)

Elemenda * <= 0.0.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/elemenda/#developers

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database

Credit

Francesco Carlucci
.