What’s Vulnerable › Vulnerabilities
CVE-2024-8239: Starbox < 3.5.3 - Contributor+ Stored XSS
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2024-09-30 · updated 2026-06-17
- Weakness: CWE-79
Description
The Starbox WordPress plugin before 3.5.3 does not properly render social media profiles URLs in certain contexts, like the malicious user's profile or pages where the starbox shortcode is used, which may be abused by users with at least the contributor role to conduct Stored XSS attacks.
Affected products
- cifi Starbox – the Author Box for Humans: before 3.5.3 — fixed in 3.5.3
How to fix
Upgrade to a fixed version: cifi Starbox – the Author Box for Humans 3.5.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-8239 or the next vulnerability affects your stack