Skip to content
Sign in
6.5 Medium

CVE-2024-2697 The socialdriver-framework WordPress plugin before 2024.0.0 does not validate and escape some of its shortcode…

Description

The socialdriver-framework WordPress plugin before 2024.0.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.

Affected products and versions

Product Affected versions Fixed in
socialdriver-framework 2024.0 earliest → < 2024.0.0 2024.0.0
socialdriver-framework 2024.0 earliest → < 2024.0.0 2024.0.0

Other CVEs of socialdriver-framework

The 4 CVEs of socialdriver-framework →
CVE-2024-2872 The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which… 4.8 Medium CVE-2024-2870 The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape a parameter before outputting… 6.1 Medium CVE-2024-2696 The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which… 4.8 Medium
Track this CVE