CVE-2024-11719: tarteaucitron.js for WordPress < 0.3.0 - Stored XSS via CSRF
The tarteaucitron-wp WordPress plugin before 0.3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11719?
CVE-2024-11719 is classified as a medium severity vulnerability due to its potential for allowing stored XSS attacks through CSRF exploitation.
How do I fix CVE-2024-11719?
To fix CVE-2024-11719, update the tarteaucitron-wp WordPress plugin to version 0.3.0 or later.
What is the impact of CVE-2024-11719?
The impact of CVE-2024-11719 allows attackers to execute stored XSS payloads on the behalf of logged-in administrators.
Which versions of tarteaucitron-wp are affected by CVE-2024-11719?
CVE-2024-11719 affects all versions of the tarteaucitron-wp plugin prior to version 0.3.0.
What type of vulnerability is CVE-2024-11719?
CVE-2024-11719 is a cross-site scripting (XSS) vulnerability that is exacerbated by a lack of CSRF protections.