CVE-2024-12166

Summary

CVE-2024-12166 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Shortcodes Blocks Creator Ultimate plugin for WordPress. This issue, present in all versions up to 2.2.0, stems from insufficient input sanitization and output escaping in the 'page' parameter. Unauthenticated attackers can exploit this vulnerability by injecting arbitrary web scripts, which can be executed if a user is tricked into taking a specific action like clicking on a malicious link. This poses a significant security risk, particularly for sites with a large user base or those handling sensitive data.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.