CVE-2024-11781

Summary

CVE-2024-11781 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Smart Agenda plugin for WordPress. This issue, present in versions 4.6 and below, allows authenticated attackers with contributor-level access or higher to inject malicious scripts into the plugin's 'smartagenda' shortcode. These scripts will be executed whenever a user accesses an injected page, potentially leading to unintended actions or data exposure. The root cause of the vulnerability is insufficient input sanitization and output escaping on user-supplied attributes.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.