CVE-2024-1445

Summary

CVE-2024-1445 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Page scroll to id plugin for WordPress. This issue, present in all versions up to 1.7.8, allows authenticated attackers with contributor-level permissions or higher to inject malicious scripts. The vulnerability is due to insufficient sanitization and output escaping of user-supplied attributes in the plugin's shortcodes. Consequently, injected pages will execute the attacker's scripts whenever a user accesses them.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.