CVE-2024-11227

Summary

CVE-2024-11227 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Memberlite Shortcodes plugin for WordPress. This issue, present in all versions up to 1.3.9, allows authenticated attackers with contributor-level access or higher to inject malicious scripts into the memberlite_accordion shortcode. The insufficient input sanitization and output escaping on user-supplied attributes enable the attacker to execute their code whenever a user accesses the manipulated page. This vulnerability poses a significant risk to websites utilizing the Memberlite Shortcodes plugin and emphasizes the importance of keeping WordPress installations updated to ensure security.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.