CVE-2024-35170

The Sticky Banner plugin for WordPress versions from n/a through 1.2.0 contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is improper neutralization of user input during web page generation, enabling the injection of malicious scripts into banner content [1].

Exploitation requires a privileged user role to perform an action such as clicking a malicious link or visiting a crafted admin page. Once triggered, the injected script is stored on the server and executed when other users (including visitors) access the affected banner [1].

An attacker can leverage this to inject arbitrary HTML and JavaScript payloads, which may be used for redirects, displaying advertisements, or other malicious activities. This vulnerability is mass-exploitable in campaigns targeting thousands of websites regardless of their size or popularity [1].

The vulnerability has been patched in version 1.3.0. Users are advised to update immediately or enable auto-updates via Patchstack [1].