CVE

Stored Cross-Site Scripting (Stored XSS) is a critical web security vulnerability that allows attackers to inject malicious scripts into a website, which are then executed in the browsers of unsuspecting users. This article focuses on CVE-2024-10703, a Stored XSS vulnerability found in versions below 2.13.4 of the “Registrations for The Events Calendar” plugin for WordPress. This vulnerability can be exploited by an attacker with administrator privileges to inject harmful scripts that execute when users interact with certain elements of the website.

The GDPR Cookie Compliance plugin for WordPress is widely used to help websites comply with the European Union’s General Data Protection Regulation (GDPR). One of the core features of the plugin is its cookie consent banner, which informs users about the use of cookies and requests their consent. However, a critical vulnerability, CVE-2025-1622, has been identified in the plugin. This Stored Cross-Site Scripting (XSS) vulnerability allows an attacker with editor-level access to inject malicious JavaScript into the “Cookie Banner Content” field. Once saved, the injected script is stored and executed when the banner is displayed on the site’s frontend, potentially leading to account takeover and the creation of backdoor admin accounts. With over 300,000 active installations, this vulnerability poses a significant security risk for WordPress websites using the GDPR Cookie Compliance plugin.

WordPress plugins play a crucial role in extending the functionality of websites. However, vulnerabilities in these plugins can introduce significant security risks. One such vulnerability has been discovered in the Stylish Price List plugin (versions below 7.1.12), which enables users to create visually appealing price lists and pricing tables. The vulnerability allows a malicious actor to inject and store JavaScript code, leading to a Stored Cross-Site Scripting (XSS) attack that can compromise an administrator’s session.

The Social Slider Feed plugin for WordPress is used to display social media feeds, such as YouTube videos, Instagram posts, and Twitter feeds, directly on websites. It allows users to create widgets that can be customized with various settings, including titles and content descriptions. However, a critical vulnerability, CVE-2024-10149, has been discovered in this plugin. This Stored Cross-Site Scripting (XSS) vulnerability allows attackers with editor-level access to inject malicious JavaScript code into the widget settings, which is later executed when the widget is viewed on the frontend. This vulnerability could lead to account takeover and the creation of backdoor admin accounts. With over 50,000 active installations, this issue represents a significant security risk to WordPress sites using the Social Slider Feed plugin.

In the ever-evolving landscape of cybersecurity, vulnerabilities in WordPress plugins remain a persistent threat. One such recent discovery is CVE-2024-9390, a Stored Cross-Site Scripting (XSS) vulnerability affecting versions of the RegistrationMagic plugin prior to 6.0.2.1. This flaw allows attackers with certain privileges to inject malicious scripts, which can execute arbitrary JavaScript in the administrator’s session, potentially leading to account hijacking or further exploitation of the system.

The Download Manager plugin for WordPress is commonly used to manage and secure downloadable files, including documents, images, and other resources. It allows administrators to set up password-protected downloads to restrict access to certain files. However, a critical vulnerability, CVE-2024-13126, has been discovered that allows unauthenticated users to bypass password protection and download all files from the plugin’s directory, including those that are meant to be password-protected. This vulnerability, stemming from improper directory listing configurations, exposes the protected content to unauthorized users. With over 100,000 active installations, this issue poses a significant security risk to WordPress websites using the Download Manager plugin.

WordPress plugins are essential tools that enhance the functionality of websites, allowing users to extend features without modifying core code. However, security vulnerabilities in plugins can expose websites to serious threats, including Cross-Site Scripting (XSS) attacks. One such vulnerability has been identified in the “MB Custom Post Types & Custom Taxonomies” plugin (CVE-2024-10143), allowing stored XSS exploitation that could lead to administrative account creation and malicious script execution.

Form Maker by 10Web is a versatile WordPress plugin used to create and manage various forms, such as contact forms, surveys, and registration forms. However, a critical vulnerability, CVE-2024-13053, has been discovered in the plugin, which allows attackers to inject malicious JavaScript into the plugin’s settings. This vulnerability, a Stored Cross-Site Scripting (XSS) flaw, enables attackers with editor-level access to execute arbitrary JavaScript code. This could lead to session hijacking, privilege escalation, or the creation of backdoor admin accounts. With over 50,000 active installations, the vulnerability poses a significant risk to WordPress sites using Form Maker.

Hubbub Lite, a popular WordPress plugin for social sharing, allows users to integrate share buttons for major social networks such as Facebook, Twitter (X), Pinterest, and LinkedIn. However, a recently discovered vulnerability (CVE-2024-10145) exposes websites to stored cross-site scripting (XSS) attacks. This flaw could allow malicious actors to inject harmful scripts, leading to account hijacking and unauthorized actions within the site.

Logo Slider is a WordPress plugin used to create image carousels and sliders, often utilized by businesses and websites to showcase logos, brands, or featured partners. A critical Stored Cross-Site Scripting (XSS) vulnerability, CVE-2024-12308, has been identified in the plugin, which allows a contributor-level user to inject malicious JavaScript into the “Logo Slider” settings. The vulnerability allows the injected script to execute when a user hovers over the carousel. This action can result in admin account creation, providing the attacker with full control over the site. With over 20,000 active installations, this vulnerability poses a serious risk to WordPress websites using the Logo Slider plugin.