CVE-2024-13122
CVSS 3.1 Score 3.5 of 10 (low)
Details
Published Mar 25, 2025
Updated: Apr 1, 2025
CWE ID 79
Summary
CVE-2024-13122 is a vulnerability affecting the AFI WordPress plugin before version 1.100.0. This issue permits high privilege users, including admins, to execute Stored Cross-Site Scripting (XSS) attacks. Despite the unfiltered_html capability being disallowed, especially in multisite configurations, the plugin fails to sanitize and escape certain settings, making these attacks possible.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.