CVE-2024-9270

Summary

CVE-2024-9270 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Lenxel Core plugin for Lenxel Learning Management System (LMS) in WordPress. This issue, present in all versions up to 1.1, allows authenticated attackers with Author-level access or higher to inject malicious scripts into SVG files. These scripts can then execute when any user accesses the affected file, potentially leading to unintended actions or data exposure. This vulnerability is caused by insufficient input sanitization and output escaping during the SVG file upload process.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.