CVE-2024-11750
CVSS 3.1 Score 6.4 of 10 (medium)
Details
Summary
CVE-2024-11750 is a Stored Cross-Site Scripting vulnerability affecting the ONLYOFFICE DocSpace plugin for WordPress. The shortcoming lies in the insufficient input sanitization and output escaping of user-supplied attributes in the plugin's 'onlyoffice-docspace' shortcode. This issue allows authenticated attackers, with contributor-level access or higher, to inject malicious web scripts that will be executed whenever an injected page is accessed. WordPress users are advised to upgrade to the latest version of the ONLYOFFICE DocSpace plugin to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.