CVE-2024-2000

CVSS 3.1 Score 6.7 of 10 (medium)

Details

Published Mar 13, 2024

CWE ID 787

Summary

CVE-2024-2000 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Premium Addons PRO plugin for WordPress. This issue, present in all versions up to 2.9.12, stems from insufficient input sanitization and output escaping in the 'navigation_dots' parameter of the Multi Scroll Widget. Authenticated attackers with contributor-level access or higher can exploit this vulnerability by injecting arbitrary web scripts. These scripts will execute whenever a user accesses an injected page, posing a significant security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Android

Affected Vendors

Google

Advisories, Assessments, and Mitigations

https://app.recordedfuture.com/live/sc/entity/uZ3m_2
https://www.cve.org/CVERecord?id=CVE-2024-2000
https://nvd.nist.gov/vuln/detail/CVE-2024-2000

Back to Vulnerability Database