CVE-2024-2237: Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Global Badge Module
The Premium Addons PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Global Badge module in all versions up to, and including, 2.9.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2237?
CVE-2024-2237 is classified as a medium severity vulnerability due to its potential impact on authenticated users.
How do I fix CVE-2024-2237?
To fix CVE-2024-2237, update the Premium Addons PRO plugin to version 2.9.13 or later, as this version includes the necessary security patches.
Who is affected by CVE-2024-2237?
Authenticated users with contributor-level access and versions of Premium Addons PRO up to 2.9.12 are affected by CVE-2024-2237.
What type of vulnerability is CVE-2024-2237?
CVE-2024-2237 is a Stored Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts.
What does CVE-2024-2237 exploit?
CVE-2024-2237 exploits insufficient input sanitization and output escaping in the Global Badge module of the Premium Addons PRO plugin.