FunnelKit Funnel Builder PRO <=3.4.5 Authenticated Stored XSS via allow_iframe_tag_in_post (CVE-2024-1056)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Funnel Kit Funnel Builder PRO <= 3.4.5 Authenticated (Contributor+) Stored Cross-Site Scripting via allow_iframe_tag_in_post 2. Vulnerability Description: - The FunnelKit Funnel Builder Pro plugin contains a vulnerability that allows arbitrary script and iframe tag injection via the function in all versions (including 3.4.5). - This enables attackers with Contributor-level permissions or higher to inject malicious scripts, which will execute when users visit the compromised pages. 3. Vulnerability Rating: - CVSS Score: 6.4 (Medium) - Scope of Impact: All versions (<= 3.4.5) 4. Disclosure Date: August 28, 2024 5. Update Date: August 29, 2024 6. Fix Status: Fixed (in version 3.5.0) 7. Affected Versions: <= 3.4.5 8. Fixed Version: 3.5.0 9. Vulnerability Type: Cross-Site Scripting (XSS) 10. Vulnerability ID: CVE-2024-1056 11. Disclosure Status: Publicly disclosed 12. Source: myaccount.funnelkit.com 13. Vulnerability Details: - Provides detailed information about the vulnerability and its impact. - Offers remediation advice: update to version 3.5.0 or higher. 14. Copyright Information: - Copyright held by Defiant Inc. and MITRE Corporation. - Includes licensing and usage terms for reproducing this information. 15. Contact Information: - Contact email for Defiant Inc.: wfi-support@wordfence.com. This information helps users understand the severity, scope, and remediation steps for the vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

FunnelKit Funnel Builder PRO <=3.4.5 Authenticated Stored XSS via allow_iframe_tag_in_post (CVE-2024-1056)

More from this source