CVE-2024-5796

Name of the Vulnerable Software and Affected Versions: Infinite theme for WordPress versions up to, and including, 1.1.2

Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages via the project url parameter. This enables the execution of injected scripts whenever a user accesses an injected page.

Recommendations: For Infinite theme for WordPress versions up to, and including, 1.1.2, update to a version that addresses the insufficient input sanitization and output escaping issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.