CVE-2024-10309: Tracking Code Manager < 2.4.0 - Contributor+ Stored XSS
The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10309?
CVE-2024-10309 has a medium severity rating due to the potential for Cross-Site Scripting attacks.
How do I fix CVE-2024-10309?
To fix CVE-2024-10309, update the Tracking Code Manager WordPress plugin to version 2.4.0 or later.
Who is affected by CVE-2024-10309?
Users with WordPress sites running the Tracking Code Manager plugin versions prior to 2.4.0 are affected by CVE-2024-10309.
What type of vulnerability is CVE-2024-10309?
CVE-2024-10309 is a Cross-Site Scripting (XSS) vulnerability that affects the output sanitization of metabox settings.
What versions are vulnerable to CVE-2024-10309?
All versions of the Tracking Code Manager plugin before 2.4.0 are vulnerable to CVE-2024-10309.