Reflected Cross-Site Scripting Vulnerability in Simple Certain Time to Show Content Plugin for WordPress
CVE-2024-10152

Currently unrated

Key Information:

Vendor
WordPress
Status
Simple Certain Time To Show Content
Vendor
CVE Published:
26 February 2025

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The Simple Certain Time to Show Content WordPress plugin, prior to version 1.3.1, is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability. This issue arises from a failure to properly sanitize and escape user input before rendering it back on the page. As a result, attackers could exploit this weakness to inject malicious scripts that execute in the context of users with high privileges, including administrators. This vulnerability poses significant risks to the security of WordPress sites, emphasizing the need for timely updates and vigilant security practices.

Affected Version(s)

Simple Certain Time to Show Content 0 < 1.3.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-10152 - Proof of Concept

References

https://wpscan.com/vulnerability/b4d17da2-4c47-4fd1-a6bd-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bob Matyas
WPScan
.