WordPress Theme Vulnerable to Stored Cross-Site Scripting

CVE-2024-9775

Summary

The Anih - Creative Agency WordPress Theme is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability that arises from an incomplete blacklist and inadequate input sanitization processes. This issue allows authenticated users, such as those with administrator-level permissions, to introduce arbitrary web scripts into pages. The malicious scripts execute whenever a user visits the compromised page. This vulnerability specifically impacts multi-site installations and setups where the unfiltered_html capability has been disabled, posing a risk to user security.

References