CVE-2024-6708: Profile Builder <= 3.12.0 - Admin+ Stored Cross Site Scripting
The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6708?
The severity of CVE-2024-6708 is considered high due to the potential for Admin+ users to execute Cross-Site Scripting attacks.
How do I fix CVE-2024-6708?
To fix CVE-2024-6708, update the User Profile Builder plugin to version 3.12.2 or later.
What is the impact of CVE-2024-6708?
The impact of CVE-2024-6708 allows unauthorized execution of JavaScript in the context of the admin interface, potentially compromising site management.
Who is affected by CVE-2024-6708?
CVE-2024-6708 affects installations of User Profile Builder WordPress plugin versions prior to 3.12.2.
What does sanitizing and escaping parameters mean in the context of CVE-2024-6708?
In the context of CVE-2024-6708, sanitizing and escaping parameters means properly filtering input to prevent harmful scripts from being executed in the admin area.