CVE-2024-13679

Summary

CVE-2024-13679 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Widget BUY.BOX plugin for WordPress. This issue, present in versions 3.1.5 and below, allows authenticated attackers with contributor-level access or higher to inject malicious scripts into the 'buybox-widget' shortcode. These scripts are executed whenever a user accesses an injected page, posing a significant security risk. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.