CVE-2024-10226: Arconix Shortcodes <= 2.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode
The Arconix Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 2.1.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10226?
CVE-2024-10226 is classified as a medium severity vulnerability due to its potential for stored cross-site scripting exploits.
How do I fix CVE-2024-10226?
To fix CVE-2024-10226, update the Arconix Shortcodes plugin to version 2.1.14 or later.
What does CVE-2024-10226 exploit?
CVE-2024-10226 exploits insufficient input sanitization and output escaping on user supplied attributes in the 'box' shortcode.
Who is affected by CVE-2024-10226?
Any WordPress site using the Arconix Shortcodes plugin version 2.1.13 or earlier is affected by CVE-2024-10226.
When was CVE-2024-10226 discovered?
CVE-2024-10226 was disclosed in 2024, impacting various versions of the Arconix Shortcodes plugin.