Reflected Cross-Site Scripting Vulnerability in PostLists Plugin for WordPress
CVE-2024-10815
Key Information:
Badges
Summary
The PostLists WordPress plugin, up to version 2.0.2, is vulnerable to a reflected cross-site scripting (XSS) issue due to improper handling of the $_SERVER['REQUEST_URI'] parameter. This flaw allows malicious actors to inject harmful scripts into the web page, potentially compromising user data in older web browsers that do not adequately protect against such attacks. Users should consider updating their plugins promptly to mitigate risks associated with this vulnerability.
Affected Version(s)
PostLists 0 <= 2.0.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved