CVE-2024-2220: Button contact VR <= 4.7 - Admin+ Stored XSS
The Button contact VR WordPress plugin through 4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2220?
CVE-2024-2220 has a severity rating that indicates a potential for high privilege users to exploit Stored Cross-Site Scripting vulnerabilities.
How do I fix CVE-2024-2220?
To fix CVE-2024-2220, ensure you update the Button contact VR WordPress plugin to the latest version that addresses this security vulnerability.
What types of attacks can be performed using CVE-2024-2220?
CVE-2024-2220 allows for Stored Cross-Site Scripting attacks, enabling malicious scripts to be executed in the context of the user’s session.
Who is affected by CVE-2024-2220?
CVE-2024-2220 affects high privilege users, such as administrators, using the Button contact VR plugin on WordPress.
What versions of WordPress are impacted by CVE-2024-2220?
CVE-2024-2220 affects versions of the Button contact VR WordPress plugin up to and including 4.7.