CVE-2024-9017

Vulnerability

Specifics The PeepSo Core: Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.4.6.0. The flaw resides in the Group Description field, where insufficient input sanitization and output escaping enable attackers to store malicious scripts.

Exploitation

Prerequisites An attacker must be authenticated with at least Subscriber-level access to the WordPress site. The attack is performed by saving a crafted payload into the Group Description field; the injected script will execute in the browsers of any users who view the affected group description page. No additional privileges or network-level access are required beyond standard WordPress user roles.

Impact and

Mitigation Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, credential theft, or further defacement within the WordPress instance. As of the publication date (2025-07-03), no patch has been released; the vendor's changelog [1] does not mention a fix. Administrators should restrict group creation permissions and apply input validation plugins as a temporary workaround.