5.4
CVE-2024-6859
- EPSS 0.17%
- Veröffentlicht 08.09.2024 06:15:02
- Zuletzt bearbeitet 11.09.2024 16:19:18
- Quelle contact@wpscan.com
- CVE-Watchlists
- Unerledigt
LoginWP MultiTasking <= 0.1.12 - Reflected XSS via Shortcode
WP MultiTasking <= 0.1.12 - Reflected Cross-Site Scripting
The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Mögliche Gegenmaßnahme
WP MultiTasking – WP Utilities: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ngothang ≫ Wp Multitasking SwPlatformwordpress Version <= 0.1.12
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
WP MultiTasking – WP Utilities
Version
*-0.1.12
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.17% | 0.067 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.4 | 2.3 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 5.4 | 2.3 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
https://wpscan.com/vulnerability/34ae6121-304f-495b-bcc1-4fbd3d70a9fb/
https://www.wordfence.com/threat-intel/vulnerabilities/id/1862242a-9a00-4e6b-94a2-5599200f1040