CVE-2024-2500 in ColorMag Plugin

Resumen (Inglés)

The ColorMag theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authentciated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Responsable

Wordfence

Reservar

2024-03-15

Divulgación

2024-03-22

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
257597	ColorMag Plugin Display Name secuencias de comandos en sitios cruzados	79	No está definido	No está definido	CVE-2024-2500

Fuentes

• MITRE
• NVD
• CVE Details