CVE-2024-11876

Name of the Vulnerable Software and Affected Versions Kredeum NFTs versions up to, and including, 1.6.9

Description The Kredeum NFTs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'kredeum opensky' shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Recommendations For versions up to, and including, 1.6.9, update to a version later than 1.6.9 to mitigate the risk of Stored Cross-Site Scripting. As a temporary workaround, consider disabling the 'kredeum opensky' shortcode until a patch is available. Restrict access to pages that use the 'kredeum opensky' shortcode to minimize the risk of exploitation.