CVE-2024-2430 Website Content in Page or Post < 2024.04.09 - Contributor+ Stored Cross-Site Scripting

2024-07-1206:00:04

WPScan

github.com

cve-2024-2430

wordpress plugin

stored cross-site scripting

contributor role

AI Score

5.9

Confidence

High

EPSS

Percentile

14.5%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

The Website Content in Page or Post WordPress plugin before 2024.04.09 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:matteoenna:website_content_in_page_or_post:*:*:*:*:*:*:*:*"
    ],
    "vendor": "matteoenna",
    "product": "website_content_in_page_or_post",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2024.04.09",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]