Mollie Plugin Vulnerable to Reflected Cross-Site Scripting

CVE-2024-11684

What is CVE-2024-11684?

The Kudos Donations plugin for WordPress has a vulnerability related to Reflected Cross-Site Scripting (XSS) due to improper input sanitization and output escaping. An attacker could exploit the vulnerability via the 's' parameter, enabling them to inject malicious scripts into web pages. This scenario becomes critical when an unsuspecting user interacts with a manipulated link, potentially leading to session hijacking or unauthorized actions. All versions up to and including 3.2.9 are affected, highlighting the importance of updating to version 3.3.0 or later to mitigate this risk.

References