CVE-2024-12722: Twitter Bootstrap Collapse aka Accordian Shortcode <= 1.0 - Stored XSS via Shortcode
The Twitter Bootstrap Collapse aka Accordian Shortcode WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12722?
CVE-2024-12722 has a medium severity rating due to the potential for unauthorized content injection by users with contributor roles.
How do I fix CVE-2024-12722?
To fix CVE-2024-12722, update the Twitter Bootstrap Collapse WordPress plugin to version 1.0 or later.
Who is affected by CVE-2024-12722?
Users with contributor roles and above in WordPress installations utilizing the vulnerable Twitter Bootstrap Collapse plugin are affected by CVE-2024-12722.
What is the cause of CVE-2024-12722?
CVE-2024-12722 is caused by the lack of validation and escaping of shortcode attributes in the Twitter Bootstrap Collapse plugin.
What types of attacks can exploit CVE-2024-12722?
CVE-2024-12722 can be exploited for cross-site scripting (XSS) attacks due to the improper handling of user input in post content.