CVE-2024-9638
CVSS 3.1 Score 4.8 of 10 (medium)
Details
Published Jan 7, 2025
CWE ID 79
Summary
CVE-2024-9638 is a vulnerability affecting the Category Posts Widget plugin in WordPress before version 4.9.18. This issue allows high privilege users, such as admins, to execute Stored Cross-Site Scripting attacks, bypassing the security measure that disallows the unfiltered_html capability in multisite setups. The vulnerability lies in the plugin's lack of proper sanitization and escaping of certain settings. This poses a significant risk to WordPress websites running the affected version of the plugin.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.