CVE-2024-10881

Summary

CVE-2024-10881: A critical vulnerability affects the LUNA RADIO PLAYER plugin for WordPress. This issue, occurring in versions up to 6.24.11.07, permits authenticated attackers with contributor-level access and above to inject malicious scripts. The vulnerability stems from insufficient sanitization and output escaping on user-supplied attributes within the 'lunaradio' shortcode, enabling the execution of arbitrary web scripts whenever users access injected pages.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.