CVE-2024-13663

Summary

CVE-2024-13663 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Coaching Staffs plugin for WordPress. All versions up to and including 1.4 are impacted. This issue arises due to insufficient input sanitization and output escaping on user-supplied attributes in the 'mstw-cs-table' shortcode. Consequently, authenticated attackers with contributor-level access and above can inject arbitrary web scripts, which will execute whenever a user accesses an injected page. This poses a significant security risk, as it can lead to data theft, unauthorized access, or other malicious activities. It is strongly recommended that users update to the latest version of the Coaching Staffs plugin to mitigate this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.