CVE-2024-13119

Summary

CVE-2024-13119 is a vulnerability affecting the Paid Membership Plugin for WordPress before version 4.15.20. The flaw lies in the plugin's settings, which do not undergo proper sanitization and escaping. This oversight enables high privilege users, such as admins, to execute Stored Cross-Site Scripting (XSS) attacks, bypassing the unfiltered_html capability restriction, even in multisite setups.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.