CVE-2024-5485

Summary

CVE-2024-5485 is a stored Cross-Site Scripting (XSS) vulnerability affecting the SureTriggers plugin for WordPress. The issue lies in the plugin's Trigger Link shortcode, which fails to properly sanitize and escape user-supplied attributes. As a result, authenticated attackers with contributor-level access or higher can inject malicious scripts into pages. These scripts will be executed whenever an user visits the manipulated page. This vulnerability puts WordPress sites using the SureTriggers plugin, version 1.0.47 and below, at risk for potential data theft, unauthorized account access, and other malicious activities.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.