CVE-2024-13667

Summary

CVE-2024-13667 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Uncode theme for WordPress. This issue, present in all versions up to 2.9.1.6, impacts users with Subscriber-level access and above. The root cause is insufficient input sanitization and output escaping, enabling attackers to inject arbitrary web scripts into the 'mle-description' parameter. These scripts will execute whenever an unsuspecting user accesses an injected page.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.