CVE-2024-0703

Summary

CVE-2024-0703: The WordPress plugin "Sticky Buttons – floating buttons builder" is vulnerable to Stored Cross-Site Scripting (XSS). This issue arises due to insufficient input sanitization and output escaping, allowing authenticated attackers with administrator-level access to inject arbitrary web scripts. Only multi-site installations and installations where unfiltered_html has been disabled are affected. Attackers can exploit this vulnerability to execute malicious scripts whenever a user accesses an injected page.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.