PT-2024-17950 · WordPress · Responsive Pricing Table

Dmitry Ignatyev · Published 2024-03-07 · Updated 2024-08-27 · CVE-2024-1333

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Responsive Pricing Table WordPress plugin versions prior to 5.1.11

Description The issue concerns a Stored Cross-Site Scripting flaw in the Responsive Pricing Table WordPress plugin. This flaw could allow users with the author role and above to perform attacks by embedding malicious code in a page or post where the related shortcode is used. The plugin does not properly validate and escape some of its Pricing Table options before outputting them. This could potentially enable unauthorized creation of admin accounts.

Recommendations For versions prior to 5.1.11, update to version 5.1.11 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Pricing Table options to minimize the risk of exploitation. Avoid using the vulnerable plugin functionality until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-1333

Affected Products

Responsive Pricing Table

References · 8

• 🔥 https://wpscan.com/vulnerability/30546402-03b8-4e18-ad7e-04a6b556ffd7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-1333 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1333 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1769794095940083792 · Twitter Post
• https://twitter.com/CVEnew/status/1769747140165665020 · Twitter Post
• https://twitter.com/cleantalkcloud/status/1765992557140435271 · Twitter Post
• https://t.me/cvenotify/92414 · Telegram Post
• https://t.me/cvenotify/74152 · Telegram Post