tarteaucitron-wp WordPress Plugin Vulnerable to Stored Cross-Site Scripting
Date: 2025-05
Affected: composer/couleurcitron/tarteaucitron-wp
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2024-11718
CWE: CWE-79
CVSS: 4.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)

The tarteaucitron-wp WordPress plugin before 0.3.0 allows author level and above users to add HTML into a post/page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.


Mitigations:

Architectural layers (MAESTRO):