Cross-Site Scripting Vulnerability in wp-publications WordPress Plugin
CVE-2024-11605
Key Information:
- Vendor
Wordpress
- Status
- Vendor
- CVE Published:
- 27 December 2024
Badges
What is CVE-2024-11605?
The wp-publications plugin for WordPress, through version 1.2, is susceptible to a vulnerability that results from improper handling of filenames. This issue arises when the plugin fails to escape filenames before displaying them on web pages. As a result, this oversight may permit users with elevated privileges, such as administrators, to execute stored cross-site scripting (XSS) attacks. This vulnerability is particularly concerning in environments where unfiltered HTML inputs are restricted, such as in multisite setups, thereby highlighting the need for prompt action to mitigate potential exploits.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
wp-publications 0 <= 1.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved