CVE-2024-9023

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-9023
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-9023.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-9023
Published
2024-09-28T02:15:10Z
Modified
2024-12-26T00:53:24.150385Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

The WP-WebAuthn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wwaloginform shortcode in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

References

Affected packages

Git / github.com/yrccondor/wp-webauthn

Affected ranges

Type
GIT
Repo
https://github.com/yrccondor/wp-webauthn
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7ba904e1020a15ea593301b05ecfc4d74aa61570

Affected versions

0.*

0.1.0

1.*

1.0.0
1.0.1
1.0.11
1.0.12
1.0.15
1.0.16
1.0.2
1.0.3
1.0.7
1.0.8
1.0.9
1.1.0
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.3.0
1.3.1