CVE-2024-12592

Summary

CVE-2024-12592: The Sellsy WordPress plugin, affecting versions up to 2.3.3, is susceptible to Stored Cross-Site Scripting (XSS) attacks. Malicious scripts can be injected via the 'testSellsy' shortcode, due to insufficient input sanitization and output escaping on user-supplied attributes. Attackers with contributor-level access or higher can exploit this vulnerability, injecting scripts that will execute whenever an end-user accesses an infected webpage. This poses a significant risk to site integrity and can lead to data theft or unauthorized account access.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.