CVE-2024-9702
CVSS 3.1 Score 5.4 of 10 (medium)
Details
Published Jan 7, 2025
Updated: Feb 25, 2025
CWE ID 79
Summary
CVE-2024-9702 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Social Rocket – Social Sharing Plugin for WordPress. This issue, present in versions up to 1.3.4, exposes a weakness in the plugin's 'socialrocket-floating' shortcode. Attackers with contributor-level access or higher can exploit this flaw by injecting malicious scripts into user-supplied attributes. Consequently, these scripts will execute whenever a user accesses an injected page, posing a potential security risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.