CVE-2024-10108: WPAdverts – Classifieds Plugin <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via adverts_add Shortcode
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's advertsadd shortcode in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10108?
CVE-2024-10108 is considered a high severity vulnerability due to its potential for stored cross-site scripting attacks.
How do I fix CVE-2024-10108?
To fix CVE-2024-10108, update the WPAdverts – Classifieds Plugin to version 2.1.7 or later.
What are the potential impacts of CVE-2024-10108?
The potential impacts of CVE-2024-10108 include the ability to execute arbitrary scripts in the context of a user's browser session.
Which versions of WPAdverts are affected by CVE-2024-10108?
All versions of the WPAdverts – Classifieds Plugin up to and including 2.1.6 are affected by CVE-2024-10108.
Is CVE-2024-10108 easy to exploit?
Yes, CVE-2024-10108 can be easily exploited by unauthenticated users due to insufficient input sanitization.