Reflected Cross-Site Scripting Vulnerability in Quran Text & Audio Plugin

CVE-2024-11973

What is CVE-2024-11973?

The Quran Multilanguage Text & Audio plugin for WordPress experiences a Reflected Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping mechanisms. This vulnerability affects all versions up to and including 2.3.21, allowing unauthenticated attackers to manipulate the 'sourate' and 'lang' parameters. If successfully exploited, attackers can inject arbitrary web scripts, posing significant risks when users are tricked into clicking malicious links. It’s crucial for users of the affected plugin to apply updates and implement security measures to protect against potential exploitation.

References