Stored Cross-Site Scripting Vulnerability in Accordion Slider Plugin for WordPress

CVE-2024-9582

What is CVE-2024-9582?

The Accordion Slider plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) caused by inadequately sanitized input within the 'html' attribute of the accordion slider. This vulnerability impacts all versions of the plugin up to and including 1.9.11. Authenticated attackers, particularly those with Contributor-level access or higher, can exploit this flaw to inject arbitrary web scripts into pages. The executed scripts will activate whenever a user loads the compromised page. It's important to note that for successful exploitation, Contributor-level users need access to the plugin's admin area, management of which is typically restricted to Administrator-level users by default.

References