CVE-2024-6859: WP MultiTasking <= 0.1.12 - Reflected XSS via Shortcode
The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6859?
CVE-2024-6859 is classified as a medium severity vulnerability due to the risk of Stored Cross-Site Scripting (XSS) exploitation.
How do I fix CVE-2024-6859?
To fix CVE-2024-6859, update the WP MultiTasking plugin to version 0.1.13 or later.
Who is affected by CVE-2024-6859?
CVE-2024-6859 affects users with contributor role and above on websites using the vulnerable versions of the WP MultiTasking plugin.
What types of attacks can CVE-2024-6859 lead to?
CVE-2024-6859 can lead to Stored Cross-Site Scripting (XSS) attacks that allow attackers to execute malicious scripts in the users' browsers.
Is CVE-2024-6859 specific to certain WordPress environments?
CVE-2024-6859 is specific to WordPress sites using the WP MultiTasking plugin version 0.1.12 or earlier.