CVE-2024-2237

The Premium Addons PRO plugin for WordPress contains a stored cross-site scripting vulnerability in its Global Badge module affecting versions 2.9.12 and earlier, caused by inadequate sanitization of user input and improper escaping of output. Attackers with contributor-level privileges or higher can inject malicious scripts into pages, which execute when other users view those pages. The vulnerability requires authentication but poses a risk to any WordPress installation using affected versions of the plugin. Upgrading to version 2.9.13 or later resolves this security issue.

Based on public CVE data (MITRE/NVD).