Cross-Site Scripting Vulnerability in wp-publications WordPress Plugin
CVE-2024-11605
Key Information:
- Vendor
- WordPress
- Status
- WP-publications
- Vendor
- CVE Published:
- 27 December 2024
Badges
Summary
The wp-publications plugin for WordPress, through version 1.2, is susceptible to a vulnerability that results from improper handling of filenames. This issue arises when the plugin fails to escape filenames before displaying them on web pages. As a result, this oversight may permit users with elevated privileges, such as administrators, to execute stored cross-site scripting (XSS) attacks. This vulnerability is particularly concerning in environments where unfiltered HTML inputs are restricted, such as in multisite setups, thereby highlighting the need for prompt action to mitigate potential exploits.
Affected Version(s)
wp-publications 0 <= 1.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved