WordPress Jobs Plugin <2.7.8 Stored XSS Vulnerability (CVE-2024-10104)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Plugin Name: Jobs for WordPress < 2.7.8 - Contributor+ Stored XSS 2. Description: The plugin does not properly sanitize and escape certain job settings, allowing users with elevated privileges (such as Contributors) to perform stored cross-site scripting (XSS) attacks. 3. Proof of Concept: - Log in as a user with Contributor privileges. - Navigate to the Job panel and click "Add New Job". - In the panel, input text into the Job Title field. - Add the XSS payload to the "Working Hours" field, then save. - When previewing the page, the payload will trigger. 4. Affected Plugin: job-postings 5. Fix Status: Fixed in version 2.7.8. 6. Reference: CVE-2024-10104 7. Classification: - Type: XSS - OWASP Top 10: A7: Cross-Site Scripting (XSS) - CWE: CWE-79 - CVSS: 5.9 (Medium) 8. Additional Information: - Original Researcher: Krugov Artyom - Submitter: Krugov Artyom - Submitter Website: https://research.cleantalk.org - Verified: Yes - WPVDB ID: f0a9c8ae-f2cf-4322-8216-4778b0e37a48 - Publication Date: 2024-10-25 (approximately 22 days ago) - Added Date: 2024-10-25 (approximately 22 days ago) - Last Updated: 2024-10-25 (approximately 22 days ago) 9. Other Vulnerabilities: - Dynamic Widgets < 1.6 - Reflected Cross-Site Scripting - Ivory Search < 4.7 - Reflected Cross-Site Scripting - WP Reroute Email < 1.5.0 - Unauthenticated Stored Cross-Site Scripting - Custom Field For WP Job Manager < 1.2 - Admin+ Stored XSS - Pricing Table by Supsystic < 1.9.5 - Reflected Cross-Site Scripting This information provides a detailed description of the vulnerability, its scope of impact, fix status, and relevant references and verification details.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Jobs Plugin <2.7.8 Stored XSS Vulnerability (CVE-2024-10104)

More from this source