WP AdCenter <=2.5.6 Authenticated Stored XSS via ad_alignment Attribute (CVE-2024-8317)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: - WP AdCenter - Ad Manager & Adsense Ads <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ad_alignment Attribute 2. Vulnerability Type: - Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) 3. Vulnerability ID: - CVE-2024-8317 4. CVSS Score: - 6.4 (Medium) 5. Public Release Date: - September 5, 2024 6. Update Date: - September 6, 2024 7. Researcher: - Francesco Carlucci 8. Affected Versions: - <= 2.5.6 9. Fixed Versions: - 2.5.7 10. Vulnerability Description: - Describes a security flaw in the WP AdCenter plugin where improper input handling leads to Cross-Site Scripting (XSS) attacks. 11. Reference Links: - plugins.trac.wordpress.org - wordpress.org - plugins.trac.wordpress.org 12. Exploitation: - This vulnerability allows attackers with Contributor+ privileges to inject malicious scripts via the attribute. When users visit the compromised page, the injected scripts will be executed. 13. Remediation Recommendation: - Upgrade to version 2.5.7 or higher. 14. Copyright and Licensing Information: - Copyright and licensing information is provided by Defiant Inc. and MITRE Corporation. 15. Vulnerability Database: - Wordfence Intelligence’s WordPress vulnerability database is free and accessible via API for querying and analysis. This information helps users understand the details of the vulnerability, how to remediate it, and how to prevent exploitation.

Goal Reached Thanks to every supporter — we hit 100%!

WP AdCenter <=2.5.6 Authenticated Stored XSS via ad_alignment Attribute (CVE-2024-8317)

More from this source