CVE-2024-12463

Summary

CVE-2024-12463 is a new Stored Cross-Site Scripting (XSS) vulnerability affecting the Arena.IM – Live Blogging for real-time events plugin for WordPress. This issue exists in all versions up to 0.3.0 due to insufficient input sanitization and output escaping on user-supplied attributes within the 'arena_embed_amp' shortcode. Attackers with contributor-level access and above can exploit this vulnerability by injecting arbitrary web scripts, which will execute whenever a user visits an injected page, posing a significant security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.