CVE-2024-11753: UMich OIDC Login <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
The UMich OIDC Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'umichoidcbutton' shortcode in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11753?
CVE-2024-11753 has a medium severity due to its potential for exploitation via stored cross-site scripting.
How do I fix CVE-2024-11753?
To fix CVE-2024-11753, upgrade the UMich OIDC Login plugin to a version higher than 1.2.0.
What are the consequences of CVE-2024-11753?
CVE-2024-11753 can allow an attacker to execute malicious scripts in the context of users, leading to unauthorized access and data theft.
Which software versions are affected by CVE-2024-11753?
CVE-2024-11753 affects all versions of the UMich OIDC Login plugin for WordPress up to and including version 1.2.0.
Who is responsible for addressing CVE-2024-11753?
Website administrators using the UMich OIDC Login plugin for WordPress are responsible for updating the plugin to mitigate CVE-2024-11753.