CVE-2024-3977

CVE-2024-3977: WordPress Jitsi Shortcode <= 0.1 - Admin+ Stored XSS

Vendor Unknown
Product WordPress Jitsi Shortcode
Published June 14, 2024
Last update August 1, 2024

CVSS base score

What the vulnerability does

01Description

The WordPress Jitsi Shortcode WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Key dates

02Disclosure timeline

June 14, 2024 CVE published
August 1, 2024 Record updated