CVE-2024-7355
CVSS V2 None
CVSS V3 None
Description
The Organization chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_input’ and 'node_description' parameter in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure charts can be extended to subscribers.
Overview
- CVE ID
- CVE-2024-7355
- Assigner
- Wordfence
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-08-07T12:30:17.310Z
- Last Modified Date
- 2024-08-07T13:12:15.350Z
Weakness Enumerations
References
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2024-7355 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7355 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-08-08 13:05:04 | Added to TrackCVE |