CVE-2024-11877

Name of the Vulnerable Software and Affected Versions Cricket Live Score plugin for WordPress versions prior to 2.0.2

Description The issue is related to Stored Cross-Site Scripting via the plugin's 'cricket score' shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Recommendations For versions prior to 2.0.2, update to the latest version (2.0.2) immediately to mitigate the risks. As a temporary workaround, consider restricting access to the 'cricket score' shortcode until the update is applied.