CVE-2024-2688

Summary

CVE-2024-2688 is a stored Cross-Site Scripting (XSS) vulnerability affecting the EmbedPress plugin for WordPress, specifically the document widget. The issue arises due to insufficient input sanitization and output escaping on user-supplied attributes. This flaw enables authenticated attackers with contributor-level access and above to inject malicious scripts into pages. When a user accesses an injected page, the scripts will execute, potentially leading to unintended actions or data exposure. Versions of the plugin up to, and including, 3.9.12 are vulnerable to this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.