Threat Entry Updated 2024-12-21

CVE-2024-12697 - Real Kit Plugin

The real.Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Real Kit

CVE-2024-12697

MEDIUM CVSS 6.4 2024-12-21

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-02-26

CVE-2023-0364 - Real Kit Plugin

The real.Kit WordPress plugin before 5.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

PLUGIN Real Kit

CVE-2023-0364

MEDIUM CVSS 5.4 2023-03-20

Risk Score

Open Full Technical Breakdown