CVE-2024-11380

Summary

CVE-2024-11380 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Mini Program API plugin for WordPress. This issue, present in all versions up to 1.4.5, allows authenticated attackers with contributor-level access or higher to inject malicious scripts. The vulnerability stems from insufficient sanitization and output escaping of user-supplied attributes within the plugin's 'qvideo' shortcode. As a result, any page containing an injected 'qvideo' shortcode will execute the attacker's web scripts whenever a user accesses the page.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.