CVE-2024-13769: Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the 'themeoptionsajaxpostaction' AJAX action in all versions up to, and including, 4.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings and inject malicious web scripts. The developer opted to remove the software from the repository, so an update is not available and it is recommended to find a replacement software.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13769?
CVE-2024-13769 is classified as a Stored Cross-Site Scripting vulnerability, which can allow attackers to inject malicious scripts into web pages.
How do I fix CVE-2024-13769?
To fix CVE-2024-13769, update the Puzzles WP Magazine / Review with Store WordPress Theme to version 4.2.5 or higher, which addresses the missing capability check.
What versions of the Puzzles WP Magazine / Review with Store WordPress Theme are affected by CVE-2024-13769?
CVE-2024-13769 affects all versions of the Puzzles WP Magazine / Review with Store WordPress Theme up to and including version 4.2.4.
What does CVE-2024-13769 impact?
CVE-2024-13769 impacts the security of the Puzzles WP Magazine / Review with Store WordPress Theme, allowing for potential exploitation through stored XSS attacks.
Who is the vendor for CVE-2024-13769?
The vendor for CVE-2024-13769 is Puzzles, the developer of the WP Magazine / Review with Store WordPress Theme.