Reflected Cross-Site Scripting Vulnerability in Page Parts Plugin

CVE-2024-11360

What is CVE-2024-11360?

The Page Parts plugin for WordPress is susceptible to Reflected Cross-Site Scripting (XSS) due to improper handling of URLs using the remove_query_arg function across all versions up to and including 1.4.3. This vulnerability allows unauthenticated attackers to exploit the application by injecting arbitrary scripts. If successful, the injected scripts can execute in the context of users who interact with exploited links, thereby compromising user data and leading to potential malicious activities.

References