CVE-2024-10874: Quotes llama <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Quotes llama plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quotes-llama' shortcode in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10874?
CVE-2024-10874 has a medium severity rating due to its potential for exploitation via stored cross-site scripting.
How do I fix CVE-2024-10874?
To fix CVE-2024-10874, update the Quotes Llama plugin to version 3.0.1 or later.
What versions are affected by CVE-2024-10874?
CVE-2024-10874 affects all versions of the Quotes Llama plugin up to and including version 3.0.0.
Can CVE-2024-10874 lead to data theft?
Yes, CVE-2024-10874 can allow attackers to steal sensitive user data through malicious scripts.
Is my WordPress site at risk with CVE-2024-10874?
If you are using the affected version of the Quotes Llama plugin on your WordPress site, you are at risk from CVE-2024-10874.