CVE-2024-8239 Starbox < 3.5.3 - Contributor+ Stored XSS
Contributors can inject malicious scripts via social media profile URLs in the Starbox WordPress plugin, leading to stored XSS attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-8239?
CVE-2024-8239 is a medium-severity cross-site scripting vulnerability in Unknown Starbox, published on 30 Sep 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The Starbox WordPress plugin before 3.5.3 does not properly render social media profiles URLs in certain contexts, like the malicious user's profile or pages where the starbox shortcode is used, which may be abused by users with at least the contributor role to conduct Stored XSS attacks.
Weakness: CWE-79
Which versions are affected by CVE-2024-8239?
It affects 1 product.
Products include Squirrly Starbox.
How do I fix CVE-2024-8239?
No fix has been published for CVE-2024-8239 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-8239 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-8239 exists.
Other vulnerabilities in Unknown Starbox
- CVE-2023-6806 Starbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Job Settings
- CVE-2024-0256 Starbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Display Name and Social Settings
- CVE-2024-1273 Starbox < 3.5.0 - Contributor+ Stored XSS
- CVE-2024-7955 Starbox < 3.5.2 - Admin+ Stored XSS
- CVE-2024-0366 Starbox – the Author Box for Humans <= 3.4.7 - Insecure Direct Object Reference
Sources
Also known as GHSA-f25r-g5v8-v6qj.