CVE-2024-13705

Summary

CVE-2024-13705 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the StageShow plugin for WordPress. This issue, present in all versions up to 9.8.6, stems from the improper use of the 'remove_query_arg' function without adequate escaping. Consequently, unauthenticated attackers can inject malicious scripts into web pages, potentially gaining control over user sessions. Exploitation of this vulnerability relies on tricking users into clicking on malicious links.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.