Taufique Noorani
·
Published
2025-01-31
·
Updated
2025-05-23
·
CVE-2024-12872
4.8
Medium
| Base vector | Vector | AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
Zalomení WordPress plugin versions 1.5 and earlier
Description:
The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a multisite setup. This occurs because the plugin does not properly sanitise and escape some of its settings.
Recommendations:
For Zalomení WordPress plugin versions 1.5 and earlier, consider disabling the plugin until a patch is available to prevent potential Stored Cross-Site Scripting attacks.
Restrict access to the plugin's settings for high privilege users to minimize the risk of exploitation.
Exploit
Fix
XSS