CVE-2024-10709

Summary

CVE-2024-10709 is a vulnerability affecting the YaDisk Files WordPress plugin before version 1.2.6. This issue allows users with the contributor role and above to execute stored Cross-Site Scripting (XSS) attacks. The plugin does not properly validate and escape certain shortcode attributes, enabling attackers to inject malicious scripts into webpages or posts where the shortcode is used. Successful exploitation of this vulnerability may lead to unauthorized access, data theft, or site defacement. WordPress users are advised to update to the latest plugin version or disable the plugin as a temporary measure until a patch is available.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.