CVE-2024-12588

Summary

CVE-2024-12588 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Phlox theme plugin for WordPress. The Staff widget in all versions up to 2.16.4 is the source of the issue. Attackers with contributor-level access and above can exploit this vulnerability due to insufficient input sanitization and output escaping on user-supplied attributes. This allows them to inject arbitrary web scripts, which will execute whenever a user accesses an injected page. This poses a significant risk, as it can lead to unauthorized access, data theft, or website defacement. It is crucial for users to update the Phlox theme plugin to the latest version to mitigate this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.