CVE-2024-9304

Summary

CVE-2024-9304 identifies a vulnerability in the LocateAndFilter plugin for WordPress, affecting all versions up to and including 1.6.14, which allows for Stored Cross-Site Scripting through SVG file uploads due to inadequate input sanitization and output escaping. Authenticated attackers with Author-level access or higher can exploit this flaw to inject arbitrary web scripts that execute when users access the affected SVG files. The vulnerability has a medium base severity score of 6.4 and an exploitability score of 3.1, indicating a low attack complexity and requiring low privileges. Organizations can mitigate this risk by updating the LocateAndFilter plugin to the latest version and ensuring proper input validation processes are in place. Failure to address this vulnerability may lead to unauthorized script execution on user pages, potentially compromising user data integrity and confidentiality.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.