CVE-2024-13419

Summary

Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveOptions() and importThemeOptions() functions in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings which includes custom JavaScript that is enabled site-wide. This issue was escalated to Envato over two months from the date of this disclosure and the issue is still vulnerable.

Affected Software

VendorProductVersion RangeStatus
G5ThemeBenaa Framework0 <= 4.0.0affected
G5ThemeApril Framework0 <= 5.1affected
G5ThemeBeyot Framework0 <= 6.0.6affected
G5ThemeAuteur Framework0 <= 7.1affected

Weaknesses

  • CWE-862: CWE-862 Missing Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References