Stored Cross-Site Scripting Vulnerability in Elemenda Plugin for WordPress

CVE-2024-9373

What is CVE-2024-9373?

The Elemenda plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitization and output escaping related to SVG file uploads. This vulnerability allows authenticated attackers with Author-level access and above to embed malicious scripts within SVG files. When a user accesses these files, the injected scripts can execute, potentially compromising the integrity of the site and the safety of user information. It is crucial for users and administrators to address this issue by updating to newer, secured versions of the plugin to prevent exploitation.

References