CVE-2024-6927: Viral Signup <= 2.1 - Admin+ Stored XSS
The Viral Signup WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6927?
CVE-2024-6927 has a critical severity rating due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2024-6927?
To fix CVE-2024-6927, update the Viral Signup WordPress plugin to the latest version beyond 2.1.
Who is affected by CVE-2024-6927?
CVE-2024-6927 primarily affects high-privilege users, such as admins, using versions of the Viral Signup plugin up to 2.1.
What are the potential impacts of CVE-2024-6927?
CVE-2024-6927 could allow high-privilege users to perform stored cross-site scripting attacks, potentially compromising site security.
Is CVE-2024-6927 relevant for multisite setups?
Yes, CVE-2024-6927 is particularly relevant in multisite setups where certain capabilities are restricted.