CVE-2024-5645

Summary

CVE-2024-5645 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Envo Extra plugin for WordPress. This issue, which exists in all versions up to 1.8.23, allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. The vulnerability lies in the 'button_css_id' parameter within the Button widget, where insufficient input sanitization and output escaping have been implemented. As a result, injected pages will execute whenever a user accesses them. This poses a significant security risk, as attackers can exploit this vulnerability to launch malicious scripts and potentially gain unauthorized access to user data.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.