CVE-2024-7759: PWA For WP & AMP < 1.7.72 Administrator+ Stored XSS
The PWA for WP WordPress plugin before 1.7.72 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7759?
The severity of CVE-2024-7759 is considered high due to its potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2024-7759?
To fix CVE-2024-7759, update the PWA for WP & AMP plugin to version 1.7.72 or later immediately.
Who is affected by CVE-2024-7759?
CVE-2024-7759 affects high privilege users, such as admins, who use the PWA for WP & AMP plugin versions before 1.7.72.
Can CVE-2024-7759 be exploited in multisite setups?
Yes, CVE-2024-7759 can be exploited in multisite setups even if the unfiltered_html capability is disallowed.
What type of attack does CVE-2024-7759 allow?
CVE-2024-7759 allows for Stored Cross-Site Scripting (XSS) attacks due to insufficient sanitization of settings.