Vulnerability Description
The Tabs Shortcode WordPress plugin through 2.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tabs Shortcode Project | Tabs Shortcode | <= 2.0.2 |
Related Weaknesses (CWE)
References
- https://wpscan.com/vulnerability/76ae8f5b-2d0e-4bf5-9ae3-f76cd52dea8d/ExploitThird Party Advisory
FAQ
What is CVE-2024-11606?
CVE-2024-11606 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The Tabs Shortcode WordPress plugin through 2.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could all...
How severe is CVE-2024-11606?
CVE-2024-11606 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-11606?
Check the references section above for vendor advisories and patch information. Affected products include: Tabs Shortcode Project Tabs Shortcode.