CVE-2024-11410

Summary

CVE-2024-11410 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the YooBar plugin for WordPress. This issue, present in versions up to 2.0.6, allows authenticated attackers with Contributor-level access or higher to inject malicious scripts into the Top and footer bars for announcements, notifications, advertisements, and promotions. By exploiting insufficient input sanitization and output escaping, the attacker can execute arbitrary web scripts on pages that unsuspecting users will access. This poses a significant security risk as the injected scripts can steal sensitive information, modify content, or even take control of the affected WordPress site. Users are advised to upgrade to the latest version of the YooBar plugin to mitigate this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.