CVE-2024-12437

Name of the Vulnerable Software and Affected Versions Marketplace Items plugin for WordPress versions up to, and including, 1.5.5

Description The issue is related to Stored Cross-Site Scripting via the plugin's 'envato' shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Recommendations For versions up to, and including, 1.5.5, consider disabling the envato shortcode until a patch is available to prevent exploitation. Restrict access to pages that use the envato shortcode to minimize the risk of arbitrary web script injection. Avoid using user-supplied attributes in the envato shortcode until the issue is resolved. Update to a version that includes the necessary input sanitization and output escaping fixes for the envato shortcode.