CVE-2024-3672: BA Book Everything <= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'all-items' shortcode in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping on user supplied attributes such as 'classes'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-32576 is likely a duplicate of this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2024-3672?
CVE-2024-3672 is a Stored Cross-Site Scripting vulnerability in the BA Book Everything plugin for WordPress that affects versions up to 1.6.8 due to inadequate input sanitization.
What are the potential impacts of CVE-2024-3672?
The potential impacts of CVE-2024-3672 include unauthorized script execution in the context of the user’s session, leading to data theft or site compromise.
How can I fix CVE-2024-3672?
To fix CVE-2024-3672, update the BA Book Everything plugin to version 1.6.9 or later, where the vulnerability has been addressed.
Who is affected by CVE-2024-3672?
All users of the BA Book Everything plugin for WordPress running version 1.6.8 or earlier are affected by CVE-2024-3672.
When was CVE-2024-3672 disclosed?
CVE-2024-3672 was disclosed in 2024, highlighting the need for immediate updates to affected WordPress plugin versions.