Reflected XSS Vulnerability in Custom-404-Pro Plugin for WordPress
CVE-2019-15838

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Custom 404 Pro
Vendor
CVE Published:
30 August 2019

Summary

The Custom-404-Pro plugin for WordPress, prior to version 3.2.8, is susceptible to reflected Cross-Site Scripting (XSS). This vulnerability arises when user-controlled input is reflected in the server's response without proper validation or sanitization. A successful exploitation may enable attackers to execute arbitrary scripts in the context of the user's browser, potentially leading to data theft or session hijacking. It is crucial for users to update to the latest version to mitigate the risk.

References

https://wordpress.org/plugins/custom-404-pro/#developers
x_refsource_MISC
https://wpvulndb.com/vulnerabilities/9857
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.