CVE-2024-2783: XSS
First published: Tue Apr 09 2024(Updated: )
The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 6.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GamiPress | <6.9.1 | |
| openMairie Openpresse | <=6.9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-2783?
CVE-2024-2783 has been rated as a medium severity vulnerability due to the potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-2783?
To fix CVE-2024-2783, update GamiPress to version 6.9.1 or later to ensure proper input sanitization and output escaping.
What versions of GamiPress are affected by CVE-2024-2783?
All versions of GamiPress up to and including 6.9.0 are affected by CVE-2024-2783.
What type of vulnerability is CVE-2024-2783?
CVE-2024-2783 is a Stored Cross-Site Scripting vulnerability that can allow an attacker to inject malicious scripts.
Is there any workaround for CVE-2024-2783?
There is no official workaround for CVE-2024-2783, and updating to the latest version is recommended for immediate remediation.
- agent/type
- agent/description
- agent/references
- agent/first-publish-date
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/source
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/weakness
- agent/remedy
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup-request
- vendor/gamipress
- canonical/gamipress
- canonical/openmairie openpresse