CVE-2024-13901: Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site <= 2.0.6 - Authenticated (Administrator+) DOM-Based Stored Cross-Site Scripting
The Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 2.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfilteredhtml has been disabled.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13901?
CVE-2024-13901 is classified as a high severity vulnerability due to its potential for DOM-Based Stored Cross-Site Scripting, impacting the security of affected WordPress sites.
How do I fix CVE-2024-13901?
To fix CVE-2024-13901, update the Counter Box plugin for WordPress to version 2.0.7 or later, where the vulnerability has been addressed.
What is impacted by CVE-2024-13901?
CVE-2024-13901 affects all versions of the Counter Box plugin for WordPress up to and including version 2.0.6.
What type of attack does CVE-2024-13901 enable?
CVE-2024-13901 enables DOM-Based Stored Cross-Site Scripting attacks, allowing an attacker to inject malicious scripts into the affected website.
When was CVE-2024-13901 reported?
CVE-2024-13901 was reported in 2024, following the discovery of the vulnerability in the Counter Box plugin for WordPress.