CVE-2024-10584: DirectoryPress <= 3.6.16 - Authenticated (Author+) Stored Cross-Site Scripting
The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.6.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. When DirectoryPress Frontend is installed, this can be exploited by unauthenticated users.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10584?
CVE-2024-10584 is rated as a significant security vulnerability due to its potential for allowing Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-10584?
To fix CVE-2024-10584, users should update the DirectoryPress plugin to version 3.6.17 or later, which addresses this vulnerability.
Can CVE-2024-10584 affect my WordPress site?
Yes, if you are using any version of the DirectoryPress plugin up to and including 3.6.16, your WordPress site is vulnerable to CVE-2024-10584.
What types of attacks can CVE-2024-10584 enable?
CVE-2024-10584 can enable Stored Cross-Site Scripting attacks, allowing attackers to inject malicious scripts.
Is there a workaround for CVE-2024-10584 before updating?
While the best solution is to update to version 3.6.17 or later, temporarily disabling SVG file uploads can serve as a workaround for CVE-2024-10584.