CVE-2024-13862
CVSS 3.1 Score 7.1 of 10 (high)
Details
Published Mar 11, 2025
Summary
CVE-2024-13862 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the S3Bubble Media Streaming plugin for WordPress. The plugin, which supports AWS, Elementor, YouTube, and Vimeo functionality, fails to properly sanitize and escape user input before rendering it on the page. This oversight allows an attacker to inject malicious scripts into a webpage viewed by other users, potentially gaining unauthorized access or stealing sensitive information from high-privilege users, such as administrators.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.