Sidebar Shortcode Plugin Vulnerable to Stored Cross-Site Scripting

CVE-2024-9885

Summary

The Widget or Sidebar Shortcode plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting (XSS) attacks through its 'sidebar' shortcode. This flaw results from inadequate input sanitization and output escaping on user-supplied attributes. As a result, attackers with contributor-level access can inject arbitrary web scripts into pages. Whenever a user visits a page containing these scripts, the injected code executes, posing privacy and security risks to users. It is crucial for users of the plugin to review their installations and take appropriate action to ensure security.

References