CVE-2024-12203
CVSS 3.1 Score 4.4 of 10 (medium)
Details
Published Jan 17, 2025
CWE ID 79
Summary
CVE-2024-12203: A critical vulnerability affects the RSS Icon Widget plugin for WordPress, putting multi-site installations and those with disabled unfiltered_html at risk. Authenticated attackers with administrator access can exploit insufficient input sanitization and output escaping in the 'link_color' parameter, leading to Stored Cross-Site Scripting. This vulnerability allows the injection of arbitrary web scripts that execute when users access infected pages. Versions up to and including 5.2 of the plugin are impacted.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.