CVE-2024-10939

Summary

CVE-2024-10939 is a vulnerability affecting the Image Widget plugin for WordPress before version 4.4.11. This issue allows high privilege users, including administrators, to execute stored Cross-Site Scripting (XSS) attacks. The plugin does not properly sanitize and escape certain settings, making it possible for an attacker to inject malicious code, even when the unfiltered_html capability is disabled in multisite setups. Successful exploitation of this vulnerability could lead to the compromise of user accounts and sites. Users are advised to update to the latest version of the Image Widget plugin to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.