{"vulnerability": "CVE-2024-13391", "sightings": [{"uuid": "cb6d375e-0e7a-437e-91f6-1434c8614dba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13391", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/2289", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-13391\n\ud83d\udd39 Description: The MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_content_upload_guest' shortcode in all versions up to, and including, 2.9.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.\n\ud83d\udccf Published: 2025-01-18T07:05:06.023Z\n\ud83d\udccf Modified: 2025-01-18T07:05:06.023Z\n\ud83d\udd17 References:\n1. https://www.wordfence.com/threat-intel/vulnerabilities/id/1b3948ef-11be-450d-ad20-e4bebc16e790?source=cve\n2. https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3224254%40paid-membership&new=3224254%40paid-membership&sfp_email=&sfph_mail=", "creation_timestamp": "2025-01-18T07:57:29.000000Z"}, {"uuid": "479c2ce7-437d-45d3-9277-6bab10d5c78c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13391", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lfyrabncqt2s", "content": "", "creation_timestamp": "2025-01-18T07:15:59.073189Z"}, {"uuid": "ac63cd30-644e-4f9d-8251-0fa7cd3938de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13391", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113848157389547327", "content": "", "creation_timestamp": "2025-01-18T07:23:39.349284Z"}, {"uuid": "381030ae-1407-4722-bc85-6cb779126fc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13391", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lfysjwgkx32k", "content": "", "creation_timestamp": "2025-01-18T07:39:16.857533Z"}, {"uuid": "fefa06ba-a495-4738-9efc-b25a67fcccc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-13391", "type": "seen", "source": "https://t.me/cvedetector/15793", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-13391 - WordPress MicroPayments Fans Paid Creator Stored Cross-Site Scripting Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-13391 \nPublished : Jan. 18, 2025, 7:15 a.m. | 18\u00a0minutes ago \nDescription : The MicroPayments \u2013 Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_content_upload_guest' shortcode in all versions up to, and including, 2.9.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. \nSeverity: 6.4 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"18 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-18T08:42:32.000000Z"}]}