CVE-2024-12437

Summary

CVE-2024-12437: The Marketplace Items plugin for WordPress, used by thousands of websites, contains a Stored Cross-Site Scripting (XSS) vulnerability. This issue affects all versions up to 1.5.5, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes, specifically in the 'envato' shortcode. Once exploited, the injected scripts will execute whenever an unsuspecting user accesses an affected page.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.