CVE-2024-13506

Summary

CVE-2024-13506: A critical vulnerability affects the GeoDirectory and Classified Listings Directory plugins for WordPress. These plugins, used for creating business directories, are susceptible to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping. This issue allows authenticated attackers with Subscriber-level access or higher to inject arbitrary web scripts into the 'display_name' profile parameter. Consequently, injected pages will execute whenever a user accesses them, posing a significant security risk. Versions up to and including 2.8.97 are vulnerable to this exploit.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.