CVE-2024-11718: tarteaucitron-wp WordPress Plugin Vulnerable to Stored Cross-Site Scripting
Summary
CVE-2024-11718: tarteaucitron-wp WordPress Plugin Vulnerable to Stored Cross-Site Scripting. Affects couleurcitron/tarteaucitron-wp versions < 0.3.0. Fixed in 0.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tarteaucitron-wp WordPress plugin is designed to help website owners comply with GDPR regulations by managing user consent for cookies. It allows users to customize cookie consent banners and manage user preferences. However, prior to version 0.3.0, the plugin had a vulnerability that allowed users with author-level permissions and above to insert HTML into posts or pages, leading to potential security risks.
Vulnerability Detail
The vulnerability in the tarteaucitron-wp plugin arises from improper input validation, allowing users with author-level permissions to inject HTML content into posts or pages. This could lead to Stored Cross-Site Scripting (XSS) attacks, where malicious scripts are stored on the server and executed in the context of other users' browsers. The impact of this vulnerability can range from data theft to session hijacking, making it a significant security concern for websites using this plugin.
How To Fix
Minimum fixed version
0.3.0
This is the first release that contains the fix.
composer require couleurcitron/tarteaucitron-wp:0.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider restricting user permissions to prevent contributors and authors from adding HTML content to posts or pages. This can be done by adjusting user roles in the WordPress admin settings.
Conclusion
The tarteaucitron-wp WordPress plugin has a vulnerability that allows stored XSS attacks due to improper input validation. It is crucial for users to update to version 0.3.0 or later to mitigate this risk. Additionally, users can implement temporary workarounds to restrict permissions until the update can be applied.
See every vulnerability recorded for couleurcitron/tarteaucitron-wp →
FAQ
Stored XSS is a type of security vulnerability where an attacker can inject malicious scripts into content that is stored on the server. When other users access this content, the scripts are executed in their browsers, potentially compromising their data.
Users with author-level permissions and above in the WordPress site using the tarteaucitron-wp plugin are affected, as they can inject HTML into posts or pages.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As a temporary measure, restrict user permissions to prevent contributors and authors from adding HTML content until you can update the plugin.
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
