CVE-2024-9502

Summary

CVE-2024-9502 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Master Addons plugin for WordPress, specifically the Tooltip module. This flaw, present in all versions up to and including 2.0.6.7, enables authenticated attackers with contributor-level access or higher to inject malicious web scripts. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes, allowing the attacker to execute arbitrary code whenever an injected page is accessed. This poses a significant risk, as it can lead to data theft, account takeover, and website defacement. Users are advised to update the plugin to the latest version as soon as possible to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.