Stored Cross-Site Scripting Vulnerability in Twitch Integration Plugin for WordPress

CVE-2024-9897

What is CVE-2024-9897?

The StreamWeasels Twitch Integration plugin for WordPress exhibits a vulnerability that permits Stored Cross-Site Scripting (XSS) via its sw-twitch-embed shortcode. This flaw stems from inadequate input sanitization and output escaping for user-supplied attributes. As a result, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into any page that users access. When an affected page is visited, the malicious scripts execute, posing significant security risks to site visitors and potentially compromising their information.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References