CVE-2024-0561: Ultimate Posts Widget < 2.3.1 - Admin+ Stored XSS
The Ultimate Posts Widget WordPress plugin before 2.3.1 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0561?
CVE-2024-0561 is considered a high severity vulnerability due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-0561?
To mitigate CVE-2024-0561, update the Ultimate Posts Widget plugin to version 2.3.1 or later.
Who is affected by CVE-2024-0561?
CVE-2024-0561 affects installations of the Ultimate Posts Widget WordPress plugin prior to version 2.3.1.
What type of attack does CVE-2024-0561 allow?
CVE-2024-0561 allows high privilege users such as administrators to perform Stored Cross-Site Scripting attacks.
Why is input validation important in relation to CVE-2024-0561?
Input validation is crucial in CVE-2024-0561 because the lack of validation allows for unauthorized script execution through widget options.