CVE-2024-12207

Summary

CVE-2024-12207 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Toggles Shortcode and Widget plugin for WordPress. This issue, which can be exploited by authenticated attackers with administrator-level access, stems from insufficient input sanitization and output escaping in the plugin's 'content' parameter. The vulnerability allows the injection of arbitrary web scripts, which then execute whenever a user accesses an injected page. This issue only poses a threat to multi-site installations and installations where "unfiltered_html" has been disabled.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.