CVE-2024-11776

Summary

CVE-2024-11776 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the PCRecruiter Extensions plugin for WordPress. This issue exists in all versions up to 1.4.10 due to insufficient input sanitization and output escaping on user-supplied attributes in the 'PCRecruiter' shortcode. Authenticated attackers with contributor-level access or higher can exploit this vulnerability by injecting arbitrary web scripts that will execute whenever a user accesses an injected page. This poses a significant risk for websites using the vulnerable plugin, as it can lead to data theft, unauthorized account takeover, and other malicious activities. It is recommended that users of the PCRecruiter Extensions plugin upgrade to the latest version as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.