WordPress Relevanssi <4.23.1 Stored XSS Vulnerability (CVE-2024-9021)

From this webpage screenshot, the following key vulnerability information can be extracted: 1. Plugin Name: Relevanssi < 4.23.1 - Contributor+ Stored XSS 2. Description: A vulnerability was discovered during testing that allows a stored XSS attack via embedded malicious scripts, potentially leading to account takeover backdoors. 3. PoC: Proof-of-concept will be disclosed on October 10, 2024, to allow users time to update. 4. Affected Plugin: relevanssi, fixed in version 4.23.1. 5. CVE ID: CVE-2024-9021 6. URL: https://research.cleantalk.org/CVE-2024-9021/ 7. Video Link: YouTube video link 8. Classification: - Type: XSS - OWASP Top 10: A7: Cross-Site Scripting (XSS) - CWE: CWE-79 - CVSS Score: 6.8 (Medium) 9. Original Researcher: Krugov Artyom 10. Submitter: Krugov Artyom 11. Submitter Website: https://research.cleantalk.org 12. Verification Status: Yes 13. WPVDB ID: 5f25646d-b80b-40b1-bcaf-3b860ddc4059 14. Release Date: September 17, 2024 15. Added Date: September 26, 2024 16. Last Updated: September 26, 2024 17. Other Related Vulnerabilities: - February 8, 2021: Extra Charges To Payment Gateway For WooCommerce <= 2.0.2.1 - Unauthorised Arbitrary Plugin Settings Change to Stored XSS - May 23, 2023: Ultimate Dashboard < 3.7.6 - Admin+ Stored XSS - May 2, 2024: Simple Image Popup <= 2.4.0 - Authenticated (Admin+) Stored Cross-Site Scripting - March 10, 2016: WP Advanced Comment <= 0.10 - Stored Cross-Site Scripting (XSS) - July 16, 2024: AI ChatBot for WordPress - WPBot < 5.5.8 - Authenticated (Administrator+) Stored Cross-Site Scripting This information provides a detailed description of the vulnerability, its scope of impact, remediation status, and relevant security classifications and ratings.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Relevanssi <4.23.1 Stored XSS Vulnerability (CVE-2024-9021)

More from this source