CVE-2024-4217: Shortcodes Ultimate Pro < 7.1.5 - Contributor+ Stored Cross-Site Scripting XSS
Published Jul 13, 2024
·Updated
The shortcodes-ultimate-pro WordPress plugin before 7.1.5 does not properly escape some of its shortcodes' settings, making it possible for attackers with a Contributor account to conduct Stored XSS attacks.
Affected Software
2 affected components
Getshortcodes Shortcodes Ultimate Wordpress<7.1.5
Shortcodes Ultimate Shortcodes Ultimate Pro<7.1.5
Event History
Jul 13, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-4217?
The severity of CVE-2024-4217 is categorized as Medium due to the potential for Stored XSS attacks by users with Contributor accounts.
2
How do I fix CVE-2024-4217?
To fix CVE-2024-4217, update the Shortcodes Ultimate Pro plugin to version 7.1.5 or later.
3
Who is affected by CVE-2024-4217?
CVE-2024-4217 affects sites using the Shortcodes Ultimate Pro plugin versions prior to 7.1.5.
4
What kind of attack can be executed using CVE-2024-4217?
Attackers can exploit CVE-2024-4217 to conduct Stored XSS attacks through improperly escaped shortcode settings.
5
What role must a user have to exploit CVE-2024-4217?
A user must have a Contributor account to exploit CVE-2024-4217 and perform Stored XSS attacks.