WordPress Plugin Vulnerabilities

Add Widget After Content < 2.5 - Admin+ Stored XSS

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affects Plugins

Plugin icon
add-widget-after-content
Fixed in 2.5

References

CVE
CVE-2024-9892
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/e02472a8-5b88-43ad-86f3-e890b49899ad

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
ghsinfosec
Verified
No
WPVDB ID
f2719137-6dad-4672-9e98-1db248dfba85

Timeline

Publicly Published
2024-10-17 (about 1 year ago)
Added
2024-10-17 (about 1 year ago)
Last Updated
2024-10-21 (about 1 year ago)

Other

Published
Title
Published
2023-07-12
Title
Radio Forge Muses Player with Skins <= 2.5 - Reflected Cross-Site Scripting
Published
2025-04-10
Title
Crowdfunding for WooCommerce < 3.1.13 - Reflected Cross-Site Scripting
Published
2024-12-02
Title
Z-Downloads < 1.11.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2025-04-09
Title
Interactive Geo Maps < 1.6.25 - Reflected Cross-Site Scripting
Published
2023-05-11
Title
eBecas <= 3.1.3 - Admin+ Stored XSS